CVE-2026-49475: FreeSWITCH: Out-of-bounds memory access in core STUN attribute parsing
Vulnerability summary
CVE-2026-49475 is a high (CVSS 7.5) Improper Input Validation vulnerability in freeswitch. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 20.4% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 10-11-2026)
Source freshness unavailable
How is this decided?Timeline
- 09-06-2026PublishedVulnerability first disclosed.
- 09-06-2026Last modifiedVulnerability information updated.
Description
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.0, a STUN packet whose declared attribute length is shorter than the structure the parser casts to causes the parser to read and write past the end of the attribute, producing an out-of-bounds memory access on the per-leg media buffer. This issue has been patched in version 1.11.0.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
Decrease -0.22 pp
From 0.49% on 11-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Freeswitch1 product
- freeswitch< 1.11.0
Signalwire1 product
- freeswitch< 1.11.0
2 vendors · 2 products
References
2 links- github.com/signalwire/freeswitch/security/advisories/GHSA-9j6h-hc95-q926X Refsource CONFIRMThird Party Advisory