The vulnerability arises from the PREFIX(prologTok)() function in FreeSWITCH's XML parsing library, which was cloned from an older, unpatched libexpat version. This function lacks the proper encoding or decoding safeguards, leading to a CWE‑116 weakness. The CVSS score of 5.3 indicates a moderate risk, and the missing patch could cause the application to misinterpret or mishandle XML input, potentially resulting in erroneous behavior or denial of service.

SignalWire’s FreeSWITCH installations running any release earlier than 1.11.0 are affected. No specific revision numbers are listed, so all pre‑1.11.0 builds are considered vulnerable. The fixed release, 1.11.0, incorporates the necessary security changes to the expat XML tokenizer.

The exploitability remains uncertain; there is no EPSS data and the vulnerability is not listed in KEV. The likely attack vector is external input sent through XML‑RPC or similar interfaces that invoke the vulnerable tokenizer. An attacker could potentially craft malformed XML input that triggers improper decoding, leading to application instability or denial of service. The lack of detailed exploitation evidence suggests the risk is moderate but still warrants remediation.