CVE-2026-116785

Summary

A heap buffer overflow in FreeSWITCH's WebSocket frame parser allows remote attackers to corrupt memory beyond a 64 KiB receive buffer by exploiting a signed/unsigned length conversion flaw in ws_read_frame(), potentially crashing all concurrent sessions.

Exploitability

Exploitation requires an unauthenticated client to complete a WebSocket upgrade on the mod_xml_rpc endpoint, which is disabled by default, making successful exploitation contingent on the endpoint being explicitly enabled.

Blast radius

Successful exploitation can crash FreeSWITCH, terminating all active sessions and causing a denial of service across the entire telephony system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to FreeSWITCH version 1.11.2 or later, which contains the fix for the heap buffer overflow in ws_read_frame().

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.