Memory Corruption in FreeSWITCH Affects Telecommunication Software by SignalWire

CVE-2026-116783

What is CVE-2026-116783?

FreeSWITCH, a software-based telecommunications framework, is susceptible to a memory corruption vulnerability that occurs when the udptl_rx_packet() function utilizes a peer-controlled forward error correction (FEC) entry count. In versions before 1.11.2, this situation allows excessive data to be written beyond the designated memory arrays during a T.38 fax session. Consequently, any malicious peer capable of sending UDPTL data to an ongoing T.38 session can exploit this flaw, potentially leading to application crashes and disrupting active calls. While the risk of remote code execution remains unverified, safeguarding against such vulnerabilities is essential, and users are encouraged to update to version 1.11.2 or later.

References