Buffer Overflow Vulnerability in FreeSWITCH by SignalWire

CVE-2026-116574

What is CVE-2026-116574?

The vulnerability in FreeSWITCH arises from an insufficient buffer allocation in the switch_xml_ampencode() function, which is critical for processing numeric character references. This oversight allows for potential exploitation when handling remote-supplied text during serialization at specific buffer boundaries. This mismanagement permits writes beyond the allocated heap memory, leading to possible process aborts or memory corruption. Key surfaces exposed to this issue include mod_xml_cdr, conference and formatted CDR XML, along with XML Event Socket output and XML API output which serialize caller-controlled values. The vulnerability has been addressed in version 1.11.2.

References