Stack-based Buffer Overflow in FreeSWITCH Mod_Sofia Affects Versions 1.10.0 to 1.11.1

CVE-2026-116572

What is CVE-2026-116572?

FreeSWITCH, an open-source telecommunications platform, exhibits a stack-based buffer overflow vulnerability in mod_sofia affecting versions from 1.10.0 to 1.11.1. This flaw occurs when handling SIP Contact display names during dialog-event notifications, allowing a malicious peer to create a dialog with an excessively long display name. If a peer subscribes to dialog events with this overflow, it can terminate the FreeSWITCH process, disrupting all active calls. Successful exploitation typically requires presence management to be enabled and valid profile credentials, unless subscription authentication is disabled. The vulnerability is mitigated in version 1.11.2.

References