Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-116574 Details

Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_xml_ampencode() reserved only ten bytes for the widest numeric character reference produced from a four-byte UTF-8 sequence, omitting space for the terminating NUL. When remote-supplied text was serialized at the exact buffer-growth boundary, the terminator wrote one byte beyond the heap allocation. Reachable surfaces include mod_xml_cdr, conference and formatted CDR XML, XML Event Socket output, and XML API output that serializes caller-controlled values. The fixed zero-byte write can abort the process or truncate an adjacent object, while remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:5.9 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/signalwire/freeswitch/commit/28fcfd26246c112fa4b9e698433d09e4836ca1b5	[email protected]
https://github.com/signalwire/freeswitch/releases/tag/v1.11.2	[email protected]
https://github.com/signalwire/freeswitch/security/advisories/GHSA-r6vh-qmwm-h3cc	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-193	Off-by-one Error	[email protected]
CWE-787	Out-of-bounds Write	[email protected]

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes