CVE-2026-116574
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_xml_ampencode() reserved only ten bytes for the widest numeric character reference produced from a four-byte UTF-8 sequence, omitting space for the terminating NUL. When remote-supplied text was serialized at the exact buffer-growth boundary, the terminator wrote one byte beyond the heap allocation. Reachable surfaces include mod_xml_cdr, conference and formatted CDR XML, XML Event Socket output, and XML API output that serializes caller-controlled values. The fixed zero-byte write can abort the process or truncate an adjacent object, while remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.
- Score
- 5.9 medium
- Published
- 2026-11-05
- Links
- NVD · cve.org · Report wrong data
Matched ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| net/freeswitch | freeswitch | 1.11.1_3 | unaddressed | pi@FreeBSD.org |
Template for a VuXML entry
Check the version numbers before you commit this entry. Some ports share an entry in the CVE database with another port, such as sqlite2 and sqlite3. The version shown here may then be one that never existed for this port.
Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>freeswitch -- FIXME</topic>
<affects>
<package>
<name>freeswitch</name>
<range><lt>1.11.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE-2026-116574: FreeSWITCH is a Software Defined Telecom Stack
enabling the digital transformation from proprietary telecom
switches to a software implementation that runs on any commodity
hardware. Prior to 1.11.2, switch_xml_ampencode() reserved only ten
bytes for the widest numeric character reference produced from a
four-byte UTF-8 sequence, omitting space for the terminating NUL.
When remote-supplied text was serialized at the exact buffer-growth
boundary, the terminator wrote one byte beyond the heap allocation.
Reachable surfaces include mod_xml_cdr, conference and formatted
CDR XML, XML Event Socket output, and XML API output that
serializes caller-controlled values. The fixed zero-byte write can
abort the process or truncate an adjacent object, while remote code
execution has not been demonstrated. This issue is fixed in version
1.11.2.</p>
</body>
</description>
<references>
<cvename>CVE-2026-116574</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-116574</url>
</references>
<dates>
<discovery>2026-11-05</discovery>
<entry>2026-11-05</entry>
</dates>
</vuln>