CVE-2026-116780
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_event_expand_headers_check() advanced beyond its heap copy when a positive offset in ${variable:offset} exceeded the variable value's length. The following length calculation and copy appended adjacent heap memory to the expansion result, potentially exposing channel variables, credentials, allocator data, and pointer bytes. The flaw is reachable through configuration templates that slice remote input and through authenticated Event Socket eval or Event Socket expand commands; the separate channel-variable expander used by ordinary dialplan slicing is unaffected. The requester cannot choose adjacent memory and disclosure stops at a zero byte, but repeated expansion can influence the layout. This issue is fixed in version 1.11.2.
- Score
- 2.7 low
- Published
- 2026-11-05
- Links
- NVD · cve.org · Report wrong data
Matched ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| net/freeswitch | freeswitch | 1.11.1_3 | unaddressed | pi@FreeBSD.org |
Template for a VuXML entry
Check the version numbers before you commit this entry. Some ports share an entry in the CVE database with another port, such as sqlite2 and sqlite3. The version shown here may then be one that never existed for this port.
Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>freeswitch -- FIXME</topic>
<affects>
<package>
<name>freeswitch</name>
<range><lt>1.11.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE-2026-116780: FreeSWITCH is a Software Defined Telecom Stack
enabling the digital transformation from proprietary telecom
switches to a software implementation that runs on any commodity
hardware. Prior to 1.11.2, switch_event_expand_headers_check()
advanced beyond its heap copy when a positive offset in
${variable:offset} exceeded the variable value's length. The
following length calculation and copy appended adjacent heap memory
to the expansion result, potentially exposing channel variables,
credentials, allocator data, and pointer bytes. The flaw is
reachable through configuration templates that slice remote input
and through authenticated Event Socket eval or Event Socket expand
commands; the separate channel-variable expander used by ordinary
dialplan slicing is unaffected. The requester cannot choose
adjacent memory and disclosure stops at a zero byte, but repeated
expansion can influence the layout. This issue is fixed in version
1.11.2.</p>
</body>
</description>
<references>
<cvename>CVE-2026-116780</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-116780</url>
</references>
<dates>
<discovery>2026-11-05</discovery>
<entry>2026-11-05</entry>
</dates>
</vuln>