FreeSWITCH is an open-source software telecommunications platform.
FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 to 1.11.1, there is a stack-based buffer overflow in mod_sofia when processing SIP Contact display names for dialog-event notifications. A peer can establish a dialog containing an excessively long display name and subsequently subscribe to that entity’s dialog events, causing the stored value to overflow a fixed 512-byte stack buffer. Exploitation requires presence management to be enabled, directly or through shared appearance, and normally requires valid profile credentials unless subscription authentication is disabled. The overflow can terminate the FreeSWITCH process and all active calls. This vulnerability
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Signalwire
- Product
- freeswitch
- CVSS v3.1
- 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Exploitation
- SSVC none, automatable no, impact partial
- Fix
- available
- Weakness
- CWE-121, CWE-787
- Exposure class
- Collaboration
- NVD status
- Awaiting Analysis
Why it ranks 28 (Notable)
- CVSS v3.1 6.5 medium
- Product class: collaboration
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-116572 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.