CVE-2026-116574
Received Received - Intake

Heap Buffer Overflow in FreeSWITCH XML Processing

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: GitHub, Inc.

Description
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_xml_ampencode() reserved only ten bytes for the widest numeric character reference produced from a four-byte UTF-8 sequence, omitting space for the terminating NUL. When remote-supplied text was serialized at the exact buffer-growth boundary, the terminator wrote one byte beyond the heap allocation. Reachable surfaces include mod_xml_cdr, conference and formatted CDR XML, XML Event Socket output, and XML API output that serializes caller-controlled values. The fixed zero-byte write can abort the process or truncate an adjacent object, while remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-06
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-116574
EUVD
EUVD-2026-117731

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
signalwire freeswitch < 1.11.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-193 A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-116574 is a heap buffer overflow in FreeSWITCH's XML serialization function, switch_xml_ampencode(). It occurs when escaping wide Unicode characters in remote-supplied text. The function reserved insufficient space for the longest UTF-8 escape sequence plus a null terminator, causing a one-byte overflow when serializing text at specific buffer boundaries. This could corrupt adjacent memory or abort the process.

Detection Guidance

To detect this vulnerability, check FreeSWITCH version with 'freeswitch -version'. If running version 1.11.1 or earlier, the system is vulnerable. Monitor logs for crashes or truncation errors during XML serialization processes like CDR records or Event Socket outputs.

Impact Analysis

This vulnerability may cause FreeSWITCH to crash or corrupt data when processing XML output containing wide Unicode characters. Attackers could trigger it by manipulating caller IDs, SIP headers, or channel variables to include malicious UTF-8 sequences. While remote code execution isn't confirmed, the flaw could disrupt services by aborting processes or corrupting CDR records, Event Socket outputs, or XML API responses.

Mitigation Strategies

Upgrade FreeSWITCH to version 1.11.2 or later immediately. If upgrading is not possible, unload vulnerable modules like mod_xml_cdr, avoid XML serialization of remote data, or restrict access to XML API and Event Socket interfaces.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116574. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...