A stack buffer overflow exists in FreeSWITCH's mod_xml_rpc module that occurs when a credential longer than 57 characters is processed before authentication. The flaw allows an attacker to overwrite the stack and crash the application, terminating all active calls. The vulnerability stems from unsafe handling of user credentials and falls under CWE-121, CWE-131, and CWE-787. No remote code execution has been demonstrated, but the crash can disrupt service continuity.

SignalWire FreeSWITCH versions earlier than 1.11.2 are affected; the mod_xml_rpc listener is built by default but not loaded in the stock configuration. Any deployment exposing this HTTP interface can be impacted.

The flaw has a CVSS score of 7.5, indicating a high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. An unauthenticated attacker can trigger the overflow by sending a specially crafted HTTP Basic authentication request to the mod_xml_rpc endpoint. The exploit requires knowledge of an existing directory user but does not require additional privileges. While the immediate impact is denial of service, the lack of demonstrated code execution limits the threat to service disruption.