{"id":"CVE-2026-116574","kind":"vulnerability","aliases":["CVE-2026-116574"],"related":[],"title":"FreeSWITCH: one-byte heap overflow in XML encoding can crash the process","description":"FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_xml_ampencode() reserved only ten bytes for the widest numeric character reference produced from a four-byte UTF-8 sequence, omitting space for the terminating NUL. When remote-supplied text was serialized at the exact buffer-growth boundary, the terminator wrote one byte beyond the heap allocation. Reachable surfaces include mod_xml_cdr, conference and formatted CDR XML, XML Event Socket output, and XML API output that serializes caller-controlled values. The fixed zero-byte write can abort the process or truncate an adjacent object, while remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.","summary":"FreeSWITCH before 1.11.2 writes a terminating zero one byte past a heap buffer when it XML-encodes remote-supplied text at a buffer boundary. An attacker can crash the process or corrupt an adjacent object; remote code execution has not been demonstrated.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freeswitch","package","self-hosted","telecom","voip"],"not_affected_if":["fixed-version","no-remote-input","no-xml-cdr"],"how_to_check":"- Check the FreeSWITCH version with `fs_cli -x version` or `freeswitch -version`.\n- Look for `mod_xml_cdr`, conference or formatted CDR XML, or XML Event Socket output in the configuration.","fix":"- FreeSWITCH: upgrade to `1.11.2`.","status":"open","published_at":"2026-11-05T19:17:11+00:00","first_seen_at":"2026-11-05T19:40:35+00:00","triaged_at":"2026-11-05T19:43:27+00:00","updated_at":"2026-11-05T19:43:27+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T19:43:27Z","model":"claude-haiku-5-5","output":{"fix":"- FreeSWITCH: upgrade to `1.11.2`.","reach":"network","title":"FreeSWITCH: one-byte heap overflow in XML encoding can crash the process","impact":"medium","summary":"FreeSWITCH before 1.11.2 writes a terminating zero one byte past a heap buffer when it XML-encodes remote-supplied text at a buffer boundary. An attacker can crash the process or corrupt an adjacent object; remote code execution has not been demonstrated.","audience":"businesses","category":"package","nicknames":[],"who_cares":["freeswitch","telecom","voip","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"process crashes or adjacent heap object gets truncated","analyst_note":"","how_to_check":"- Check the FreeSWITCH version with `fs_cli -x version` or `freeswitch -version`.\n- Look for `mod_xml_cdr`, conference or formatted CDR XML, or XML Event Socket output in the configuration.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-xml-cdr","no-remote-input"],"who_is_affected":"Systems running FreeSWITCH before 1.11.2 that serialize caller-controlled values into XML, such as through mod_xml_cdr, conference or formatted CDR XML, XML Event Socket output, or XML API output. Deployments that do not expose these surfaces to remote input are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":4463,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116574':16A,19A '-2026':15A,18A '-8':119C '1.11.2':29B,98C,204C 'abort':182C 'adjac':62B,188C 'alloc':149C 'ampencod':101C 'api':167C 'attack':54B 'beyond':146C 'boundari':52B,140C 'buffer':39B,51B,138C 'buffer-growth':137C 'byte':4A,35B,105C,117C,145C,179C 'caller':172C 'caller-control':171C 'cdr':155C,159C 'charact':110C 'code':65B,192C 'commod':94C 'confer':156C 'control':173C 'corrupt':60B 'crash':11A,56B 'cve':14A,17A 'defin':75C 'demonstr':70B,197C 'digit':80C 'enabl':78C 'encod':9A,44B 'event':162C 'exact':136C 'execut':66B,193C 'fix':176C,201C 'format':158C 'four':116C 'four-byt':115C 'freeswitch':1A,20B,27B,71C 'growth':139C 'hardwar':95C 'heap':5A,38B,148C 'host':24B 'implement':89C 'includ':152C 'issu':199C 'mod':153C 'nul':126C 'numer':109C 'object':63B,189C 'omit':121C 'one':3A,34B,144C 'one-byt':2A 'output':164C,168C 'overflow':6A 'packag':21B 'past':36B 'prior':96C 'process':13A,58B,184C 'produc':112C 'proprietari':83C 'reachabl':150C 'refer':111C 'remot':46B,64B,129C,191C 'remote-suppli':45B,128C 'reserv':102C 'run':91C 'self':23B 'self-host':22B 'sequenc':120C 'serial':133C,170C 'socket':163C 'softwar':74C,88C 'space':122C 'stack':77C 'suppli':47B,130C 'surfac':151C 'switch':85C,99C 'telecom':25B,76C,84C 'ten':104C 'termin':32B,125C,142C 'text':48B,131C 'transform':81C 'truncat':186C 'utf':118C 'valu':174C 'version':203C 'voip':26B 'widest':108C 'write':30B,180C 'wrote':143C 'xml':8A,43B,100C,154C,160C,161C,166C 'xml-encod':42B 'zero':33B,178C 'zero-byt':177C","nicknames":[],"mitigations":[],"who_affected":"Systems running FreeSWITCH before 1.11.2 that serialize caller-controlled values into XML, such as through mod_xml_cdr, conference or formatted CDR XML, XML Event Socket output, or XML API output. Deployments that do not expose these surfaces to remote input are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freeswitch","medium","package","selfhosted","telecom","voip"],"campaign_type":null,"first_public_at":"2026-10-26T21:10:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116574","severity":null,"published_at":"2026-11-05T19:17:11+00:00","modified_at":"2026-11-05T19:17:11+00:00","first_seen_at":"2026-11-05T19:40:35+00:00","fetched_at":"2026-11-05T19:40:35+00:00","note":null}],"documents":[{"id":79178,"url":"https://github.com/signalwire/freeswitch/commit/28fcfd26246c112fa4b9e698433d09e4836ca1b5","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79176,"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79180,"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-r6vh-qmwm-h3cc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T21:10:30+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}