---
id: "CVE-2026-116788"
kind: "vulnerability"
aliases: ["CVE-2026-116788"]
title: "FreeSWITCH: heap overflow via crafted SIP PUBLISH crashes telephony server"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["freeswitch", "runtime", "self-hosted", "sip", "telephony", "voip"]
not_affected_if: ["dtd-processing-disabled", "internal-only-sip", "no-presence-sip-profile", "patched-1.11.2-or-later"]
published_at: "2026-11-05T20:17:46+00:00"
first_seen_at: "2026-11-05T20:40:46+00:00"
updated_at: "2026-11-05T20:42:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116788", "first_seen_at": "2026-11-05T20:40:46+00:00"}]
exploit_sources: []
---

# FreeSWITCH: heap overflow via crafted SIP PUBLISH crashes telephony server

FreeSWITCH before 1.11.2 has an integer underflow in switch_xml_decode() that creates an undersized heap buffer when an XML entity has an empty replacement value. An unauthenticated attacker who can reach a SIP profile with presence and DTD processing enabled can send a crafted SIP PUBLISH request to corrupt heap memory and crash the process, dropping all active calls.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the FreeSWITCH version with `fs_cli -x version` and compare it against `1.11.2`
- Look for a SIP profile with presence management enabled and DTD processing permitted in the FreeSWITCH configuration files

## Fix

- FreeSWITCH: upgrade to `1.11.2` or later

## Timeline

- 2026-11-05T20:40:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116788

## Documents

- [advisory] Vendor advisory: github.com https://github.com/signalwire/freeswitch/security/advisories/GHSA-f73w-xph4-pjp3
- [fix] Patch: github.com https://github.com/signalwire/freeswitch/commit/587474a1584488f0c04201e6e61efe76aa5bda01
- [fix] Release notes: github.com https://github.com/signalwire/freeswitch/releases/tag/v1.11.2

## From the sources

FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in  switch_xml_decode()  can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_