WebSocket Frame Handling Flaw in FreeSWITCH by SignalWire

CVE-2026-116785

What is CVE-2026-116785?

FreeSWITCH, a telecom software stack from SignalWire, has a vulnerability in the WebSocket frame handling prior to version 1.11.2. This issue occurs in the ws_read_frame() function, which inappropriately decodes a WebSocket frame's 64-bit extended payload length due to a flawed 32-bit byte swap implementation. This miscalculation can cause the surviving low word of the length to be interpreted as negative, thus bypassing the signed length check. As a result, an overflow may occur, allowing client bytes to overwrite memory beyond the designated 64 KiB buffer, potentially corrupting connection pointers and causing FreeSWITCH to crash. Although remote code execution has not yet been confirmed, this vulnerability underscores the importance of ensuring proper configurations, particularly with the mod_xml_rpc endpoint, which is disabled by default but should be monitored. The issue has been addressed in the FreeSWITCH release version 1.11.2.

References