{"id":"CVE-2026-116781","kind":"vulnerability","aliases":["CVE-2026-116781"],"related":[],"title":"FreeSWITCH: WebSocket frame handling writes past buffer before authentication","description":"FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, ws_read_frame() unmasked a WebSocket payload by iterating wsh->datalen, which included frame headers, while indexing from the payload pointer. A masked frame filling the 64 KiB receive buffer could therefore XOR up to 14 bytes beyond the buffer, and the exact-capacity case also wrote a terminating NUL one byte out of bounds. The flaw is reachable before authentication when mod_xml_rpc and its opt-in WebSocket endpoint are enabled, while both features are disabled in the stock configuration. The writes remain within the same connection handle's adjacent outbound buffer, so neither a process crash nor cross-session disclosure has been demonstrated. This issue is fixed in version 1.11.2.","summary":"FreeSWITCH's WebSocket reader unmasks payload using the wrong length, so a masked frame can write up to 14 bytes past a 64 KiB buffer. An attacker who can reach the endpoint before logging in may corrupt adjacent memory; no crash or data disclosure has been demonstrated.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freeswitch","runtime","self-hosted","telecom","voip"],"not_affected_if":["default-config","mod-xml-rpc-disabled","websocket-disabled"],"how_to_check":"- Check the FreeSWITCH version with `fs_cli -x version` and compare it to the fixed release.\n- Check whether mod_xml_rpc is loaded and its WebSocket endpoint is enabled in the xml_rpc configuration.","fix":"- FreeSWITCH: upgrade to `1.11.2`.","status":"open","published_at":"2026-11-05T20:17:45+00:00","first_seen_at":"2026-11-05T20:40:45+00:00","triaged_at":"2026-11-05T20:43:30+00:00","updated_at":"2026-11-05T20:43:30+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-05T20:43:30Z","model":"claude-haiku-5-5","output":{"fix":"- FreeSWITCH: upgrade to `1.11.2`.","reach":"network","title":"FreeSWITCH: WebSocket frame handling writes past buffer before authentication","impact":"medium","summary":"FreeSWITCH's WebSocket reader unmasks payload using the wrong length, so a masked frame can write up to 14 bytes past a 64 KiB buffer. An attacker who can reach the endpoint before logging in may corrupt adjacent memory; no crash or data disclosure has been demonstrated.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["freeswitch","telecom","voip","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Out-of-bounds writes corrupt adjacent memory in the connection buffer","analyst_note":"","how_to_check":"- Check the FreeSWITCH version with `fs_cli -x version` and compare it to the fixed release.\n- Check whether mod_xml_rpc is loaded and its WebSocket endpoint is enabled in the xml_rpc configuration.\n- unknown for any other check, since the sources do not give more.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","mod-xml-rpc-disabled","websocket-disabled"],"who_is_affected":"Only deployments that enable mod_xml_rpc and its opt-in WebSocket endpoint are exposed; both are disabled in the stock configuration. Systems that keep those features off, or that cannot reach the endpoint from untrusted networks, can skip it. The sources say the writes stay inside the same connection's outbound buffer.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000758,"input_tokens":4486,"output_tokens":618,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116781':12A,15A '-2026':11A,14A '1.11.2':97C,213C '14':41B,133C '64':45B,124C 'adjac':60B,191C 'also':144C 'attack':49B 'authent':9A,159C 'beyond':135C 'bound':153C 'buffer':7A,47B,127C,137C,193C 'byte':42B,134C,150C 'capac':142C 'case':143C 'commod':93C 'configur':181C 'connect':188C 'corrupt':59B 'could':128C 'crash':63B,198C 'cross':201C 'cross-sess':200C 'cve':10A,13A 'data':65B 'datalen':108C 'defin':74C 'demonstr':69B,206C 'digit':79C 'disabl':177C 'disclosur':66B,203C 'enabl':77C,172C 'endpoint':54B,170C 'exact':141C 'exact-capac':140C 'featur':175C 'fill':122C 'fix':210C 'flaw':155C 'frame':3A,36B,100C,111C,121C 'freeswitch':1A,16B,23B,70C 'handl':4A,189C 'hardwar':94C 'header':112C 'host':20B 'implement':88C 'includ':110C 'index':114C 'issu':208C 'iter':106C 'kib':46B,125C 'length':32B 'log':56B 'mask':35B,120C 'may':58B 'memori':61B 'mod':161C 'neither':195C 'nul':148C 'one':149C 'opt':167C 'opt-in':166C 'outbound':192C 'past':6A,43B 'payload':28B,104C,117C 'pointer':118C 'prior':95C 'process':197C 'proprietari':82C 'reach':52B 'reachabl':157C 'read':99C 'reader':26B 'receiv':126C 'remain':184C 'rpc':163C 'run':90C 'runtim':17B 'self':19B 'self-host':18B 'session':202C 'softwar':73C,87C 'stack':76C 'stock':180C 'switch':84C 'telecom':21B,75C,83C 'termin':147C 'therefor':129C 'transform':80C 'unmask':27B,101C 'use':29B 'version':212C 'voip':22B 'websocket':2A,25B,103C,169C 'within':185C 'write':5A,38B,183C 'wrong':31B 'wrote':145C 'ws':98C 'wsh':107C 'xml':162C 'xor':130C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that enable mod_xml_rpc and its opt-in WebSocket endpoint are exposed; both are disabled in the stock configuration. Systems that keep those features off, or that cannot reach the endpoint from untrusted networks, can skip it. The sources say the writes stay inside the same connection's outbound buffer.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freeswitch","medium","runtime","selfhosted","telecom","voip"],"campaign_type":null,"first_public_at":"2026-10-28T16:58:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116781","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116781","severity":null,"published_at":"2026-11-05T20:17:45+00:00","modified_at":"2026-11-05T20:17:45+00:00","first_seen_at":"2026-11-05T20:40:45+00:00","fetched_at":"2026-11-05T20:40:45+00:00","note":null}],"documents":[{"id":79864,"url":"https://github.com/signalwire/freeswitch/commit/fb9f37b9c7869630ee52a3ae87399fbbf99ad74d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79176,"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79866,"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-4cg6-rvh2-cw74","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T16:58:29+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}