CVE-2026-116574 · Package
NO FIX YET · SEE WHAT TO DO
FreeSWITCH before 1.11.2 writes a terminating zero one byte past a heap buffer when it XML-encodes remote-supplied text at a buffer boundary. An attacker can crash the process or corrupt an adjacent object; remote code execution has not been demonstrated.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Systems running FreeSWITCH before 1.11.2 that serialize caller-controlled values into XML, such as through mod_xml_cdr, conference or formatted CDR XML, XML Event Socket output, or XML API output. Deployments that do not expose these surfaces to remote input are less exposed.
Not affected if fixed-version, no-remote-input, no-xml-cdr
Who cares freeswitch, self-hosted, telecom, voip
fs_cli -x version or freeswitch -version.mod_xml_cdr, conference or formatted CDR XML, or XML Event Socket output in the configuration.1.11.2.FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_xml_ampencode() reserved only ten bytes for the widest numeric character reference produced from a four-byte UTF-8 sequence, omitting space for the terminating NUL. When remote-supplied text was serialized at the exact buffer-growth boundary, the terminator wrote one byte beyond the heap allocation. Reachable surfaces include mod_xml_cdr, conference and formatted CDR XML, XML Event Socket output, and XML API output that serializes caller-controlled values. The fixed zero-byte write can abort the process or truncate an adjacent object, while remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.