CVE-2026-116788: FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding

Vulnerability summary

CVE-2026-116788 is a high (CVSS 8.2) Heap-based Buffer Overflow vulnerability in signalwire freeswitch. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 35.5% of scored vulnerabilities.

Timeline

1. 05-11-2026
   PublishedVulnerability first disclosed.
2. 09-11-2026
   Last modifiedVulnerability information updated.

Description

FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in  switch_xml_decode()  can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.

• CWE-122Heap-based Buffer OverflowThe product writes past the end of a buffer that was allocated on the heap.
• CWE-131Incorrect Calculation of Buffer SizeThe product does not correctly calculate the size to be used when allocating a buffer.
• CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.