Description
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, msrp_parse_buffer() subtracted delimiter framing from a peer-controlled short segment whose MSRP byte range ended in * without first proving the segment was long enough. The unsigned result wrapped near SIZE_MAX and reached switch_msrp_msg_set_payload() as both an allocation size and memcpy length, while related pointer arithmetic could read before the receive buffer. The listener is disabled by default in msrp.conf.xml, but any deployment enabling an MSRP TCP or TLS port parses this framing before authentication. An unauthenticated network peer can corrupt memory and crash FreeSWITCH, dropping all active calls, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.
Published: 2026-11-05
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Denial of Service (Memory Corruption)
Action: Apply Patch
AI Analysis

Impact

FreeSWITCH vulnerable to an out-of-bounds write when parsing MSRP message bodies if a short segment ends with an asterisk. The error occurs before authentication, causing an unsigned underflow that is used as an allocation size and memcpy length, leading to memory corruption and a crash. The impact is a denial of service that can drop all active calls, and remote code execution has not been demonstrated.

Affected Systems

SignalWire FreeSWITCH deployments running any version prior to 1.11.2, such as those in the 1.10.x series. The vulnerability exists only when the MSRP TCP/TLS listener is enabled in msrp.conf.xml.

Risk and Exploitability

The CVSS score of 7.5 reflects a high severity vulnerability. Because the exploit can be triggered by an unauthenticated network peer sending crafted MSRP messages, the potential is significant for exposed deployments. EPSS is not available and the issue is not listed in CISA KEV. The attacker does not require any additional privileges beyond network connectivity to a listening MSRP port, but effective exploitation is limited to configurations where the MSRP listener is enabled by default, which is uncommon. The crash can lead to a denial of service but no confirmed remote code execution capability.

Generated by OpenCVE AI on November 5, 2026 at 20:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade FreeSWITCH to version 1.11.2 or later to apply the patch that validates segment length before parsing MSRP messages
  • If upgrading is not immediately possible, disable the MSRP listener in msrp.conf.xml or block MSRP traffic with a firewall rule to prevent unauthenticated peers from sending malformed messages
  • Monitor system logs and SIPS for signs of memory corruption or sudden disconnects, and apply additional hardening such as enforcing authentication on any exposed MSRP ports

Generated by OpenCVE AI on November 5, 2026 at 20:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Description FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, msrp_parse_buffer() subtracted delimiter framing from a peer-controlled short segment whose MSRP byte range ended in * without first proving the segment was long enough. The unsigned result wrapped near SIZE_MAX and reached switch_msrp_msg_set_payload() as both an allocation size and memcpy length, while related pointer arithmetic could read before the receive buffer. The listener is disabled by default in msrp.conf.xml, but any deployment enabling an MSRP TCP or TLS port parses this framing before authentication. An unauthenticated network peer can corrupt memory and crash FreeSWITCH, dropping all active calls, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.
Title FreeSWITCH: Pre-authentication out-of-bounds write in MSRP message body parsing
Weaknesses CWE-191
CWE-787
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-11-05T19:20:43.928Z

Reserved: 2026-10-26T15:03:39.034Z

Link: CVE-2026-116569

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-05T20:17:44.153

Modified: 2026-11-05T20:17:44.153

Link: CVE-2026-116569

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T20:30:16Z

Weaknesses
  • CWE-191

    Integer Underflow (Wrap or Wraparound)

  • CWE-787

    Out-of-bounds Write