Heap Corruption Vulnerability in FreeSWITCH Software by SignalWire
CVE-2026-49840

9.1CRITICAL

Key Information:

Vendor

Signalwire

Status
Freeswitch
Vendor
CVE Published:
9 June 2026

What is CVE-2026-49840?

FreeSWITCH, a Software Defined Telecom Stack by SignalWire, has a vulnerability that allows an untrusted ESL peer to exploit the esl_recv_event() function, leading to potential heap corruption. The issue arises due to improper parsing of the Content-Length with atol(), resulting in the possibility of passing a negative value to malloc(), which can either crash the system or corrupt memory. This vulnerability exists before version 1.11.1 and can be targeted before the client authenticates with the peer. Users are urged to upgrade to version 1.11.1 or later for protection against this issue.

Affected Version(s)

freeswitch < 1.11.1

References

https://github.com/signalwire/freeswitch/security/advisor...
x_refsource_CONFIRM
https://github.com/signalwire/freeswitch/releases/tag/v1....
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.