What is CVE-2023-40018?

CVE-2023-40018 is a high-severity vulnerability in Freeswitch, classified under Out-of-bounds Write. CVSS score: 7.5/10. Published 2023-09-15.

How severe is CVE-2023-40018?

High severity. CVSS v3 base score is 7.5 out of 10.

Buffer overflow in Freeswitch

CVE-2023-40018

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.10, FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID. When an SDP is offered with any ICE candidates with an unknown component ID, FreeSWITCH will make an out of bounds write to its arrays. By abusing this vulnerability, an attacker is able to corrupt FreeSWITCH memory leading to an undefined behavior of the system or a crash of it. Version 1.10.10 contains a patch for this issue.

Vulnerability class: Buffer Overflow

EPSS: 0.007 (51.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Freeswitch
Signalwire Freeswitch — versions < 1.10.10

Weakness classification (CWE)

CWE-787 — Out-of-bounds Write

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2023-40018?: CVE-2023-40018 is a high-severity vulnerability in Freeswitch, classified under Out-of-bounds Write. CVSS score: 7.5/10. Published 2023-09-15.
How severe is CVE-2023-40018?: High severity. CVSS v3 base score is 7.5 out of 10.