CVE-2026-116788 · Runtime
NO FIX YET · SEE WHAT TO DO
FreeSWITCH before 1.11.2 has an integer underflow in switch_xml_decode() that creates an undersized heap buffer when an XML entity has an empty replacement value. An unauthenticated attacker who can reach a SIP profile with presence and DTD processing enabled can send a crafted SIP PUBLISH request to corrupt heap memory and crash the process, dropping all active calls.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only FreeSWITCH deployments before 1.11.2 that expose a SIP profile with presence management enabled and DTD processing permitted are at risk. Attackers need network reach to that SIP profile but no account. Systems that are patched, or whose SIP profiles do not accept PUBLISH traffic from untrusted networks, can skip this.
Not affected if dtd-processing-disabled, internal-only-sip, no-presence-sip-profile, patched-1.11.2-or-later
Who cares freeswitch, self-hosted, sip, telephony, voip
fs_cli -x version and compare it against 1.11.21.11.2 or laterFreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in switch_xml_decode() can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.