An over-long SIP Contact display name can overflow a 512‑byte stack buffer in FreeSWITCH’s mod_sofia, causing the process to terminate and all active calls to drop. This vulnerability is a stack-based buffer overflow that results in a denial of service to the system and its users. No evidence is provided that the overflow allows arbitrary code execution or data disclosure. The weakness is classified as a stack buffer overflow (CWE‑121) and a bounds-checking failure (CWE‑787).

The issue affects versions 1.10.0 through 1.11.1 of the Signalwire FreeSWITCH platform. Users running these releases must upgrade to 1.11.2 or later to eliminate the vulnerable code path. The flaw is specific to the mod_sofia component that processes SIP Contact display names for dialog-event notifications.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation activity has been reported. Exploitation requires presence management to be enabled, and normally requires valid profile credentials unless subscription authentication is disabled. Attackers may trigger the overflow by establishing a dialog with an excessively long display name and then subscribing to that dialog’s events. Given the lack of evidence of remote code execution and the moderate score, the risk is primarily denial of service when absence of mitigations. The known mitigation is to apply the vendor‑supplied patch in version 1.11.2 or later, or otherwise disable the vulnerable functionality.