Stack Overflow Vulnerability in FreeSWITCH Software by SignalWire

CVE-2026-116570

What is CVE-2026-116570?

FreeSWITCH, a software-defined telecom stack developed by SignalWire, has a stack overflow vulnerability affecting versions prior to 1.11.2. The vulnerability resides in the http_directory_auth() function, which improperly handles the encoding of user credentials into a fixed-size buffer. If an attacker sends an overly long credential exceeding 57 characters using an exposed mod_xml_rpc HTTP listener, it may trigger a stack overflow. This could corrupt the stack and lead to a crash of the FreeSWITCH application, consequently terminating all active calls. Although remote code execution has not been demonstrated, the issue underscores the importance of upgrading to version 1.11.2 or later to mitigate potential risks.

References