Memory Corruption Vulnerability in FreeSWITCH Telecom Software by SignalWire

CVE-2026-116569

What is CVE-2026-116569?

FreeSWITCH, a software-defined telecom stack, is susceptible to a memory corruption vulnerability due to improper handling of peer-controlled short segments in the msrp_parse_buffer() function. Specifically, when the function processes segments that end with a delimiter before validating their length, it causes an unsigned integer underflow, which can lead to memory corruption or application crashes. Notably, while the listener is disabled by default, deployments that activate an MSRP TCP or TLS port may be at risk, allowing unauthenticated network peers to manipulate memory and disrupt ongoing calls. Remote code execution has not been reported, but the impact of dropped calls is significant. The issue has been addressed in version 1.11.2.

References