A STUN packet whose declared attribute length is shorter than the parser’s expected structure causes the FreeSWITCH STUN parser to read and write beyond the buffer boundary, creating an out‑of‑bounds memory access on the per‑leg media buffer. This can lead to memory corruption, which in theory could allow an attacker to crash the service or to execute arbitrary code if the corrupted memory is leveraged for a control‑flow hijack. The CVE description does not confirm a proven remote code execution or denial‑of‑service exploit, but the nature of the vulnerability suggests such outcomes are possible.

The vulnerability affects the SignalWire FreeSWITCH product. Any installation of FreeSWITCH older than version 1.11.0 is vulnerable. Version 1.11.0 and later contain the patch that addresses the STUN parsing issue, as released in the 1.11.0 release.

The CVSS score of 7.5 indicates high severity. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is remote network access to the STUN service, potentially requiring only the ability to send a crafted STUN packet. However, the exact exploitability, including authentication requirements or required network conditions, is not explicitly detailed, so these aspects are inferred from the known STUN behavior. Consequently, the risk remains significant for exposed deployments, but precise likelihood and attack surface details are uncertain.