{"id":"CVE-2026-116788","kind":"vulnerability","aliases":["CVE-2026-116788"],"related":[],"title":"FreeSWITCH: heap overflow via crafted SIP PUBLISH crashes telephony server","description":"FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in  switch_xml_decode()  can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.","summary":"FreeSWITCH before 1.11.2 has an integer underflow in switch_xml_decode() that creates an undersized heap buffer when an XML entity has an empty replacement value. An unauthenticated attacker who can reach a SIP profile with presence and DTD processing enabled can send a crafted SIP PUBLISH request to corrupt heap memory and crash the process, dropping all active calls.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freeswitch","runtime","self-hosted","sip","telephony","voip"],"not_affected_if":["dtd-processing-disabled","internal-only-sip","no-presence-sip-profile","patched-1.11.2-or-later"],"how_to_check":"- Check the FreeSWITCH version with `fs_cli -x version` and compare it against `1.11.2`\n- Look for a SIP profile with presence management enabled and DTD processing permitted in the FreeSWITCH configuration files","fix":"- FreeSWITCH: upgrade to `1.11.2` or later","status":"open","published_at":"2026-11-05T20:17:46+00:00","first_seen_at":"2026-11-05T20:40:46+00:00","triaged_at":"2026-11-05T20:42:55+00:00","updated_at":"2026-11-05T20:42:55+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T20:42:55Z","model":"claude-haiku-5-5","output":{"fix":"- FreeSWITCH: upgrade to `1.11.2` or later","reach":"network","title":"FreeSWITCH: heap overflow via crafted SIP PUBLISH crashes telephony server","impact":"medium","summary":"FreeSWITCH before 1.11.2 has an integer underflow in switch_xml_decode() that creates an undersized heap buffer when an XML entity has an empty replacement value. An unauthenticated attacker who can reach a SIP profile with presence and DTD processing enabled can send a crafted SIP PUBLISH request to corrupt heap memory and crash the process, dropping all active calls.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["freeswitch","sip","voip","telephony","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote crash of FreeSWITCH process, interrupting all active calls","analyst_note":"","how_to_check":"- Check the FreeSWITCH version with `fs_cli -x version` and compare it against `1.11.2`\n- Look for a SIP profile with presence management enabled and DTD processing permitted in the FreeSWITCH configuration files\n- unknown whether the sources name a specific configuration key for DTD processing","plain_action":"","needs_analyst":false,"not_affected_if":["patched-1.11.2-or-later","no-presence-sip-profile","dtd-processing-disabled","internal-only-sip"],"who_is_affected":"Only FreeSWITCH deployments before 1.11.2 that expose a SIP profile with presence management enabled and DTD processing permitted are at risk. Attackers need network reach to that SIP profile but no account. Systems that are patched, or whose SIP profiles do not accept PUBLISH traffic from untrusted networks, can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000774,"input_tokens":4368,"output_tokens":674,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116788':13A,16A '-2026':12A,15A '1.11.2':27B,96C,175C 'activ':83B,167C 'alloc':109C,126C 'attack':53B,130C 'buffer':41B,127C 'call':84B,168C 'caus':105C 'copi':123C 'corrupt':74B,157C 'craft':5A,69B,151C 'crash':8A,78B 'creat':37B 'cve':11A,14A 'declar':114C 'decod':35B,103C 'document':113C 'drop':81B 'dtd':63B,142C 'empti':48B,119C 'enabl':65B,140C 'entiti':45B,116C 'exploit':155C 'fix':172C 'freeswitch':1A,17B,25B,85C,163C 'heap':2A,40B,75B,108C,158C 'host':21B 'integ':30B,98C 'interrupt':165C 'manag':139C 'memori':76B,159C 'open':89C 'open-sourc':88C 'overflow':3A 'overrun':124C 'permit':144C 'platform':93C 'presenc':61B,138C 'process':64B,80B,143C,164C 'profil':59B,136C 'publish':7A,71B,153C 'reach':56B,133C 'replac':49B,120C 'request':72B,154C 'runtim':18B 'self':20B 'self-host':19B 'send':67B 'server':10A 'sip':6A,22B,58B,70B,135C,152C 'softwar':91C 'sourc':90C 'subsequ':122C 'switch':33B,101C 'telecommun':92C 'telephoni':9A,23B 'termin':161C 'trigger':146C 'unauthent':52B,129C 'underflow':31B,99C 'unders':39B,107C 'valu':50B,121C 'version':95C,174C 'via':4A 'voip':24B 'vulner':148C,170C 'xml':34B,44B,102C,112C","nicknames":[],"mitigations":[],"who_affected":"Only FreeSWITCH deployments before 1.11.2 that expose a SIP profile with presence management enabled and DTD processing permitted are at risk. Attackers need network reach to that SIP profile but no account. Systems that are patched, or whose SIP profiles do not accept PUBLISH traffic from untrusted networks, can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freeswitch","high","runtime","selfhosted","sip","telephony","voip"],"campaign_type":null,"first_public_at":"2026-10-28T16:55:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116788","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116788","severity":null,"published_at":"2026-11-05T20:17:46+00:00","modified_at":"2026-11-05T20:17:46+00:00","first_seen_at":"2026-11-05T20:40:46+00:00","fetched_at":"2026-11-05T20:40:46+00:00","note":null}],"documents":[{"id":79885,"url":"https://github.com/signalwire/freeswitch/commit/587474a1584488f0c04201e6e61efe76aa5bda01","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79176,"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79887,"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-f73w-xph4-pjp3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T16:55:31+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}