Buffer overflow in Signalwire Freeswitch
CVE-2026-116570
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, http_directory_auth() rebuilt an expected user@domain:password credential and base64-encoded it into an 80-byte buffer using an encoder without an output-length argument. A configured credential longer than 57 characters overflowed the stack before the supplied HTTP Basic password was compared. An unauthenticated client only needed to name an existing directory user on an exposed mod_xml_rpc HTTP listener; the module is built but not loaded by the stock configuration. The overflow can corrupt the stack and crash FreeSWITCH, ending every active call, although the overrun bytes come from the configured credential and remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Signalwire Freeswitch — versions < 1.11.2
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-116570?
- CVE-2026-116570 is a high-severity vulnerability in Signalwire Freeswitch, classified under Stack-based Buffer Overflow. CVSS score: 7.5/10. Published 2026-11-05.
- How severe is CVE-2026-116570?
- High severity. CVSS v3 base score is 7.5 out of 10.