Stack buffer overflow in FreeSWITCH mod_sofia from long SIP To-header
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
FreeSWITCH from 1.10.0 before 1.11.2 has a stack-based buffer overflow in mod_sofia when it generates dialog-event notifications. A peer that establishes a dialog with an excessively long SIP To-header user part and then subscribes to that entity's dialog events can overflow a fixed-size stack buffer (CWE-121). Exploitation requires presence or shared-appearance management to be enabled and normally requires valid profile credentials, unless subscription authentication is disabled. The overflow can terminate the FreeSWITCH process and all active calls.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 until 1.11.1, a stack-based buffer overflow in mod_sofia when generating dialog-event notifications. A peer can establish a dialog with an excessively long SIP To-header user part and subsequently subscribe to that entity’s dialog events, causing the stored value to overflow a fixed-size stack buffer. Exploitation requires presence or shared-appearance management to be enabled and normally requires valid profile credentials, unless subscription authentication is disabled. The overflow can terminate the FreeSWITCH process and all active calls. This vulnerability is fixed in version 1.11.2.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| signalwire | freeswitch | before 1.11.2 | 1.11.2 | Patch available | CNA |
- freeswitch Vendorsignalwire Affected before 1.11.2 Fixed in 1.11.2 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:freeswitch:freeswitch:*:*:*:*:*:*:*:* | — | — | freeswitch |
- cpe:2.3:a:freeswitch:freeswitch:*:*:*:*:*:*:*:* Versions — — ·freeswitch
Remediation
Upgrade signalwire FreeSWITCH to version 1.11.2, which fixes the flaw. The sources list no advisory identifier for this fix.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA freeswitch (signalwire) Fixed in 1.11.2
Timeline
- 2026-11-05 Threatist record created from CVE-2026-116573
- 2026-11-07 Priority changed: MEDIUM → LOW
References
More signalwire vulnerabilities
- TI-2023-08915 heap-over-flow in stun_parse_attribute in sofia-sip CVSS 3.1CRITICAL 9.8
- TI-2022-13049 Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP CVSS 3.1CRITICAL 9.8
- TI-2023-28097 FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
- TI-2023-20909 Resource allocation without limits in signalwire freeswitch CVSS 3.1HIGH 7.5
- TI-2023-20908 FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID CVSS 3.1HIGH 7.5
- TI-2023-15601 heap-over-flow and integer-overflow in sofia-sip CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences