{"id":"CVE-2026-116788","published":"2026-11-05T20:17:46.240","lastModified":"2026-11-05T22:38:13.080","description":"FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in  switch_xml_decode()  can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.","cvssScore":8.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cwes":["CWE-122","CWE-131","CWE-191"],"vendors":[],"products":[],"references":[{"url":"https://github.com/signalwire/freeswitch/commit/587474a1584488f0c04201e6e61efe76aa5bda01","tags":[]},{"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2","tags":[]},{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-f73w-xph4-pjp3","tags":[]}],"exploitRefs":[{"url":"https://github.com/signalwire/freeswitch/commit/587474a1584488f0c04201e6e61efe76aa5bda01","tags":[]},{"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2","tags":[]},{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-f73w-xph4-pjp3","tags":[]}],"hasPoc":true,"ai":null}