{"id":"CVE-2026-116783","kind":"vulnerability","aliases":["CVE-2026-116783"],"related":[],"title":"FreeSWITCH: crafted T.38 fax packets corrupt memory and crash calls","description":"FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, udptl_rx_packet() used a peer-controlled FEC entry count directly to fill five-entry FEC arrays in a mod_spandsp T.38 session. A larger count wrote sender-controlled error-recovery data beyond those arrays and persisted the oversized count for a later reconstruction pass. Any peer able to deliver UDPTL to an established T.38 fax session can reach the parser, including deployments using fax applications or a T.38 gateway. The memory corruption can crash FreeSWITCH and end every active call, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.","summary":"FreeSWITCH, a software telephony switch, has a memory corruption bug in its T.38 fax handling (mod_spandsp) that a peer can trigger by sending crafted UDPTL packets. The corruption can crash FreeSWITCH and drop every active call, though remote code execution has not been demonstrated.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freeswitch","runtime","self-hosted","telephony"],"not_affected_if":["no-untrusted-peers","t38-disabled"],"how_to_check":"- Check the FreeSWITCH version with `fs_cli -x version` or `freeswitch -version`\n- Check whether `mod_spandsp` is loaded and T.38 fax is enabled in your gateways or fax applications\n- Check whether the server accepts UDPTL/T.38 traffic from untrusted peers","fix":"- FreeSWITCH: move to `1.11.2` or later","status":"open","published_at":"2026-11-05T20:17:45+00:00","first_seen_at":"2026-11-05T20:40:45+00:00","triaged_at":"2026-11-05T20:42:55+00:00","updated_at":"2026-11-05T20:42:55+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-05T20:42:55Z","model":"claude-haiku-5-5","output":{"fix":"- FreeSWITCH: move to `1.11.2` or later","reach":"network","title":"FreeSWITCH: crafted T.38 fax packets corrupt memory and crash calls","impact":"medium","summary":"FreeSWITCH, a software telephony switch, has a memory corruption bug in its T.38 fax handling (mod_spandsp) that a peer can trigger by sending crafted UDPTL packets. The corruption can crash FreeSWITCH and drop every active call, though remote code execution has not been demonstrated.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["freeswitch","telephony","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Memory corruption crashes FreeSWITCH and drops all active calls","analyst_note":"","how_to_check":"- Check the FreeSWITCH version with `fs_cli -x version` or `freeswitch -version`\n- Check whether `mod_spandsp` is loaded and T.38 fax is enabled in your gateways or fax applications\n- Check whether the server accepts UDPTL/T.38 traffic from untrusted peers","plain_action":"","needs_analyst":false,"not_affected_if":["t38-disabled","no-untrusted-peers"],"who_is_affected":"Deployments running FreeSWITCH with the mod_spandsp T.38 fax path reachable by peers that can send UDPTL to an established fax session, including fax applications and T.38 gateways. Systems without T.38 fax enabled or not reachable by untrusted peers are less exposed. The sources do not describe exposure beyond this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4445,"output_tokens":612,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116783':13A,16A '-2026':12A,15A '1.11.2':95C,195C 'abl':147C 'activ':58B,179C 'although':181C 'applic':165C 'array':114C,134C 'beyond':132C 'bug':32B 'call':10A,59B,180C 'code':62B,183C 'commod':91C 'control':103C,127C 'corrupt':6A,31B,51B,172C 'count':106C,123C,139C 'craft':2A,47B 'crash':9A,53B,174C 'cve':11A,14A 'data':131C 'defin':72C 'deliv':149C 'demonstr':67B,188C 'deploy':162C 'digit':77C 'direct':107C 'drop':56B 'enabl':75C 'end':177C 'entri':105C,112C 'error':129C 'error-recoveri':128C 'establish':153C 'everi':57B,178C 'execut':63B,184C 'fax':4A,36B,155C,164C 'fec':104C,113C 'fill':109C 'five':111C 'five-entri':110C 'fix':192C 'freeswitch':1A,17B,23B,54B,68C,175C 'gateway':169C 'handl':37B 'hardwar':92C 'host':21B 'implement':86C 'includ':161C 'issu':190C 'larger':122C 'later':142C 'memori':7A,30B,171C 'mod':38B,117C 'overs':138C 'packet':5A,49B,98C 'parser':160C 'pass':144C 'peer':42B,102C,146C 'peer-control':101C 'persist':136C 'prior':93C 'proprietari':80C 'reach':158C 'reconstruct':143C 'recoveri':130C 'remot':61B,182C 'run':88C 'runtim':18B 'rx':97C 'self':20B 'self-host':19B 'send':46B 'sender':126C 'sender-control':125C 'session':120C,156C 'softwar':25B,71C,85C 'spandsp':39B,118C 'stack':74C 'switch':27B,82C 't.38':3A,35B,119C,154C,168C 'telecom':73C,81C 'telephoni':22B,26B 'though':60B 'transform':78C 'trigger':44B 'udptl':48B,96C,150C 'use':99C,163C 'version':194C 'wrote':124C","nicknames":[],"mitigations":[],"who_affected":"Deployments running FreeSWITCH with the mod_spandsp T.38 fax path reachable by peers that can send UDPTL to an established fax session, including fax applications and T.38 gateways. Systems without T.38 fax enabled or not reachable by untrusted peers are less exposed. The sources do not describe exposure beyond this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freeswitch","high","runtime","selfhosted","telephony"],"campaign_type":null,"first_public_at":"2026-10-28T17:00:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116783","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116783","severity":null,"published_at":"2026-11-05T20:17:45+00:00","modified_at":"2026-11-05T20:17:45+00:00","first_seen_at":"2026-11-05T20:40:45+00:00","fetched_at":"2026-11-05T20:40:45+00:00","note":null}],"documents":[{"id":79870,"url":"https://github.com/signalwire/freeswitch/commit/b999d2a594f025ac0dd4d7b137635308ef298272","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79176,"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79872,"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mjp3-3cq2-hxj4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T17:00:59+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}