A pre‑authentication heap buffer overflow exists in FreeSWITCH's mod_verto module. The module allocates a fixed 2 MiB buffer for a POST body yet accepts Content‑Length values up to nearly 10 MiB. The read loop is bounded by the declared length, allowing an attacker to send a body that overflows the buffer by up to approximately 8 MiB before the HTTP basic‑auth check executes. The flaw corresponds to CWE‑122 and CWE‑131 and can lead to memory corruption, denial of service, and potentially remote code execution if the attacker can inject payloads that trigger execution during the overflow.

Affected systems include all FreeSWITCH deployments from signalwire running a version prior to 1.11.1, which is identified as the last patched hit. The vulnerability is present in every build before that release and was addressed by increasing the buffer to match the maximum Content‑Length or by validating length before allocation.

The CVSS score is 9.8, indicating critical severity, and the vulnerability is not listed in KEV and its EPSS is not available, so the current estimated exploitation probability is unknown but mitigated when the preceding authentication is not reached. Attackers can exploit the flaw via an HTTP POST to the mod_verto endpoint, sending a large payload that forces the buffer overflow. Because the vulnerability triggers before authentication, the exploit does not require credentials, making it readily exploitable by any remote host that can reach the service.