CVE-2026-116788
FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in switch_xml_decode() can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.
- Score
- 8.2 high
- Published
- 2026-11-05
- Links
- NVD · cve.org · Report wrong data
Matched ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| net/freeswitch | freeswitch | 1.11.1_3 | unaddressed | pi@FreeBSD.org |
Template for a VuXML entry
Check the version numbers before you commit this entry. Some ports share an entry in the CVE database with another port, such as sqlite2 and sqlite3. The version shown here may then be one that never existed for this port.
Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>freeswitch -- FIXME</topic>
<affects>
<package>
<name>freeswitch</name>
<range><lt>1.11.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE-2026-116788: FreeSWITCH is an open-source software
telecommunications platform. Before version 1.11.2, an integer
underflow in switch_xml_decode() can cause an undersized heap
allocation when an XML document declares an entity with an empty
replacement value. Subsequent copying overruns the allocated
buffer. An unauthenticated attacker who can reach a SIP profile
with presence management enabled and DTD processing permitted can
trigger the vulnerability through a crafted SIP PUBLISH request.
Exploitation can corrupt heap memory and terminate the FreeSWITCH
process, interrupting all active calls. This vulnerability is fixed
in version 1.11.2.</p>
</body>
</description>
<references>
<cvename>CVE-2026-116788</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-116788</url>
</references>
<dates>
<discovery>2026-11-05</discovery>
<entry>2026-11-05</entry>
</dates>
</vuln>