Buffer Overflow Vulnerability in FreeSWITCH Telecom Stack

CVE-2026-115928

What is CVE-2026-115928?

FreeSWITCH, a software-defined telecom stack, has a buffer overflow vulnerability due to a flaw in the switch_core_media_add_crypto() function prior to version 1.11.2. This issue occurs when it processes a zero-length key and salt from an inbound SDP a=crypto attribute, leading to an underflow that causes a fixed stack buffer overflow. An unauthenticated caller could exploit this vulnerability to corrupt memory and crash the FreeSWITCH process, dropping active calls. Although there is no demonstrated potential for remote code execution, this vulnerability may allow unauthorized access to the SDES-SRTP parser, making it crucial for users to update to version 1.11.2 or later for protection.

References