freeswitch vulnerabilities

Latest freeswitch CVEs

Newest publication first · page 1 of 2

1. CVE-2026-116782 FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling

   Published 2026-11-05

   High·CVSS 7.5 EPSS 0.54%

   FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_i_connect() passed the first RTMP connect argument to amf0_object_get() wit...

2. CVE-2026-116783 FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery data

   Published 2026-11-05

   High·CVSS 8.2 EPSS 0.62%

   FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, udptl_rx_packet() used a peer-controlled FEC entry count directly to fill five-e...

3. CVE-2026-116790 FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY

   Published 2026-11-05

   Critical·CVSS 9.1 EPSS 0.34%

   FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepted every connectivity check without cryp...

4. CVE-2026-116788 FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding

   Published 2026-11-05

   High·CVSS 8.2 EPSS 0.41%

   FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in switch_xml_decode() can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the a...

5. CVE-2026-116780 FreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via `${variable:offset}` slicing

   Published 2026-11-05

   Low·CVSS 2.7 EPSS 0.22%

   FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_event_expand_headers_check() advanced beyond its heap copy when a positiv...

6. CVE-2026-116784 FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing

   Published 2026-11-05

   High·CVSS 7.5 EPSS 0.45%

   FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet's declared RTCP header length as...

7. CVE-2026-116779 FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands

   Published 2026-11-05

   Critical·CVSS 9.8 EPSS 2.5% CISA KEV added 2026-11-09 Exploited in the wild

   FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAG...

8. CVE-2026-116789 FreeSWITCH: DTLS-SRTP peer certificate is not bound to the SDP fingerprint when FreeSWITCH is the DTLS server

   Published 2026-11-05

   High·CVSS 7.4 EPSS 0.18%

   FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, dtls_state_setup() compared a peer certificate with the SDP a=fingerprint only w...

9. CVE-2026-116781 FreeSWITCH: Pre-authentication out-of-bounds writes in mod_xml_rpc WebSocket frame parsing

   Published 2026-11-05

   Medium·CVSS 5.3 EPSS 0.27%

   FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, ws_read_frame() unmasked a WebSocket payload by iterating wsh->datalen, which in...

10. CVE-2026-116785 FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling

    Published 2026-11-05

    Critical·CVSS 9.1 EPSS 1.1%

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, ws_read_frame() decoded a WebSocket frame's 64-bit extended payload length with...

11. CVE-2026-116786 FreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod_sofia

    Published 2026-11-05

    High·CVSS 8.8 EPSS 0.45%

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, sofia_handle_sip_i_refer() placed raw Refer-To URI parameters and headers inside...

12. CVE-2026-116787 FreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-Length

    Published 2026-11-05

    High·CVSS 7.5 EPSS 0.48%

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, mod_event_socket used an unauthenticated Content-Length value directly as the al...

13. CVE-2026-116567 FreeSWITCH: Pre-authentication stack buffer overflow in mod_rtmp control-message handling

    Published 2026-11-05

    High·CVSS 7.5 EPSS 0.43%

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_handle_control() rendered an RTMP user-control message into a 200-byte stac...

14. CVE-2026-116571 FreeSWITCH: Stack buffer overflow in mod_rtmp AVC sequence-header construction

    Published 2026-11-05

    Medium·CVSS 5.9 EPSS 0.37%

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtp2rtmpH264() built an AVC decoder configuration record in a fixed stack b...

15. CVE-2026-116570 FreeSWITCH: Pre-authentication stack buffer overflow in mod_xml_rpc HTTP directory authentication

    Published 2026-11-05

    High·CVSS 7.5 EPSS 0.55%

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, http_directory_auth() rebuilt an expected user@domain:password credential and ba...

16. CVE-2026-116569 FreeSWITCH: Pre-authentication out-of-bounds write in MSRP message body parsing

    Published 2026-11-05

    High·CVSS 7.5 EPSS 0.63%

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, msrp_parse_buffer() subtracted delimiter framing from a peer-controlled short se...

17. CVE-2026-116568 FreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsing

    Published 2026-11-05

    High·CVSS 7.5 EPSS 0.53%

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtmp2rtpH264() trusted the length prefix of each inbound H.264 NAL unit wit...

18. CVE-2026-116572 FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP Contact display-name

    Published 2026-11-05

    Medium·CVSS 6.5 EPSS 0.47%

    FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 to 1.11.1, there is a stack-based buffer overflow in mod_sofia when processing SIP Contact display names for dialog-event notifications. A peer can establish a dialog containing an excessively long dis...

19. CVE-2026-115928 FreeSWITCH: Stack buffer overflow parsing the SDP a=crypto key material on inbound calls

    Published 2026-11-05

    High·CVSS 7.5 EPSS 0.71%

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_core_media_add_crypto() passed the encoded key and salt length from an in...

20. CVE-2026-49848 FreeSWITCH: Pre-authentication `userVariables` injection in `mod_verto`

    Published 2026-06-09

    Medium·CVSS 4.3 EPSS 0.17%

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, mod_verto's check_auth userauth branch wrote request-supplied userVariab...

21. CVE-2026-49847 FreeSWITCH: Stack overflow in bundled cJSON parser via deeply nested JSON

    Published 2026-06-09

    High·CVSS 7.5 EPSS 0.41%

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, a single unauthenticated WebSocket frame containing a deeply nested JSON...

22. CVE-2026-49843 FreeSWITCH: Pre-authentication session eviction via attacker-chosen `sessid` in `mod_verto`

    Published 2026-06-09

    Medium·CVSS 5.3 EPSS 0.28%

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, mod_verto's JSON-RPC handler bound the connection to the client-supplied...

23. CVE-2026-49842 FreeSWITCH: Pre-authentication bandwidth amplification via `mod_verto` speed-test frames

    Published 2026-06-09

    High·CVSS 7.5 EPSS 0.45%

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, mod_verto's WebSocket frame loop intercepts a #-prefixed speed-test prot...

24. CVE-2026-49841 FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read

    Published 2026-06-09

    Critical·CVSS 9.8 EPSS 0.39%

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, the mod_verto HTTP request handler allocates a fixed 2 MiB buffer for a...

25. CVE-2026-49840 FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing

    Published 2026-06-09

    Critical·CVSS 9.1 EPSS 0.31%

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, esl_recv_event() parses Content-Length with atol() and passes the result...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.