Vulnerabilities

FreeSWITCH is an open-source software telecommunications platform.

FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in switch_xml_decode() can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Signalwire

Product

freeswitch

CVSS v3.1

8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Fix

available

Weakness

CWE-122, CWE-131, CWE-191

Exposure class

Collaboration

NVD status

Awaiting Analysis

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-116788 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 28
   CVE NVD 6h ago

   FreeSWITCH is an open-source software telecommunications platform.

   CVSS 6.5 Fix available CVE-2026-116572 Signalwire