BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-116788FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding

FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in  switch_xml_decode()  can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.

8.2 HIGHEPSS 0.40%Not in KEVNVD: Undergoing Analysis

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
8.2HIGH3.1GitHub_M (CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Details

CVE ID
CVE-2026-116788
Status
Undergoing Analysis
Assigner (CNA)
GitHub_M
Published
Nov 5, 2026
Last modified
2026-11-05 22:38 UTC
Weaknesses
  • CWE-122 · Heap-based Buffer Overflow
  • CWE-131 · Incorrect Calculation of Buffer Size
  • CWE-191 · Integer Underflow (Wrap or Wraparound)

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:45 UTC.