{"id":"CVE-2026-116788","aliases":["EUVD-2026-117755","GHSA-f73w-xph4-pjp3"],"status":"published","title":"FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding","description":"FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in  switch_xml_decode()  can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00409,"percentile":0.35672,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-122","CWE-131","CWE-191"],"published":"2026-11-05T19:39:44Z","modified":"2026-11-10T19:06:26Z","products":[{"vendor":"freeswitch","product":"freeswitch"},{"vendor":"signalwire","product":"freeswitch"}],"references":[{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-f73w-xph4-pjp3","tags":["x_refsource_CONFIRM","Vendor Advisory","Mitigation","advisory"]},{"url":"https://github.com/signalwire/freeswitch/commit/587474a1584488f0c04201e6e61efe76aa5bda01","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116788.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116788","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-116788","title":"FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding","description":"FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in  switch_xml_decode()  can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.","status":"published","published":"2026-11-05T19:39:44.929Z","modified":"2026-11-09T17:43:20.112Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-122","CWE-131","CWE-191"],"updated_at":"2026-11-09T19:34:28.960398Z"}],"euvd":[{"id":"EUVD-2026-117755","description":"FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in  switch_xml_decode()  can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.","status":"published","published":"2026-11-05T19:39:44Z","modified":"2026-11-09T17:43:20Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-09T19:17:50.030863Z"}],"nvd":[{"id":"CVE-2026-116788","description":"FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in  switch_xml_decode()  can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.","status":"published","published":"2026-11-05T20:17:46.24Z","modified":"2026-11-10T18:42:13.317Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122","CWE-131","CWE-191"],"updated_at":"2026-11-10T20:21:08.549394Z"}],"osv":[{"id":"CVE-2026-116788","title":"FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding","description":"FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in  switch_xml_decode()  can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.","status":"published","published":"2026-11-05T19:39:44.929Z","modified":"2026-11-12T07:04:13.033176566Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-122","CWE-131","CWE-191"],"updated_at":"2026-11-07T03:08:01.156605Z"}]}}