Heap Memory Vulnerability in FreeSWITCH Software Defined Telecom Stack
CVE-2026-116780

2.7LOW

Key Information:

Vendor

Signalwire

Status
Freeswitch
Vendor
CVE Published:
5 November 2026

What is CVE-2026-116780?

The vulnerability in FreeSWITCH allows attackers to exploit the switch_event_expand_headers_check() function, leading to a potential disclosure of sensitive information. Prior to version 1.11.2, improper handling of offsets during length calculations could result in adjacent heap memory exposure. This flaw is particularly concerning when remote input is processed via configuration templates or through authenticated Event Socket commands, allowing the risk of revealing channel variables, credentials, and other sensitive data. The vulnerability can be mitigated by updating to version 1.11.2, where this issue has been addressed.

Affected Version(s)

freeswitch < 1.11.2

References

https://github.com/signalwire/freeswitch/security/advisor...
x_refsource_CONFIRM
https://github.com/signalwire/freeswitch/commit/30cdb387a...
x_refsource_MISC
https://github.com/signalwire/freeswitch/releases/tag/v1....
x_refsource_MISC

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.