CVE-2026-49475 Details
Description
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.0, a STUN packet whose declared attribute length is shorter than the structure the parser casts to causes the parser to read and write past the end of the attribute, producing an out-of-bounds memory access on the per-leg media buffer. This issue has been patched in version 1.11.0.
A vulnerability in FreeSWITCH prior to version 1.11.0 allows for out-of-bounds memory access during the parsing of STUN packets. The issue arises because the parser does not properly validate the declared attribute length before casting it to a type-specific structure. This flaw can lead to a process crash on any ICE-enabled call leg that receives a crafted packet, terminating the FreeSWITCH process and dropping all concurrent sessions. The vulnerability affects any deployment that negotiates ICE on a media leg, particularly WebRTC profiles and certain SIP peers that negotiate ICE by default.
Users should upgrade to FreeSWITCH version 1.11.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/signalwire/freeswitch/releases/tag/v1.11.0 | [email protected] | Release Notes |
| https://github.com/signalwire/freeswitch/security/advisories/GHSA-9j6h-hc95-q926 | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freeswitch freeswitch | < 1.11.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | Initial Analysis | [email protected] |
| Jun 9, 2026 | New CVE Received | [email protected] |