CVE-2026-116569 · Runtime
NO FIX YET · SEE WHAT TO DO
A short malformed MSRP message makes FreeSWITCH compute a wrapped length and read or write memory outside its buffers before authentication. An unauthenticated network peer can crash the switch and drop all active calls, though code execution has not been demonstrated.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only deployments that enable the MSRP TCP or TLS listener are exposed, because it is disabled by default in msrp.conf.xml. Any deployment that has turned that listener on is reachable by unauthenticated network peers before any login. Deployments with MSRP off can skip it.
Not affected if default-config, msrp-disabled
Who cares freeswitch, telephony, voip
freeswitch -version and compare it with the fixed release below.msrp.conf.xml (disabled by default); look for an MSRP TCP or TLS port being bound.1.11.2.FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, msrp_parse_buffer() subtracted delimiter framing from a peer-controlled short segment whose MSRP byte range ended in * without first proving the segment was long enough. The unsigned result wrapped near SIZE_MAX and reached switch_msrp_msg_set_payload() as both an allocation size and memcpy length, while related pointer arithmetic could read before the receive buffer. The listener is disabled by default in msrp.conf.xml, but any deployment enabling an MSRP TCP or TLS port parses this framing before authentication. An unauthenticated network peer can corrupt memory and crash FreeSWITCH, dropping all active calls, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.