Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_core_media_add_crypto() passed the encoded key and salt length from an inbound SDP a=crypto attribute to switch_b64_decode() as the destination capacity. A zero-length key and salt made that capacity underflow, allowing the decoded attribute to overflow a fixed stack buffer with sender-chosen bytes before the call was answered. On the shipped external profile, an unauthenticated caller can reach the SDES-SRTP parser, while profiles that challenge inbound calls remain affected for senders who can authenticate; setting rtp_secure_media_inbound to false removes the path, and WebRTC DTLS-SRTP legs are unaffected. The overflow corrupts memory and can crash the FreeSWITCH process, dropping every active call, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-05T20:17:43.127Z",
  "pubdate": "2026-11-05T20:17:43.127Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability exists in the FreeSWITCH SDES-SRTP parser prior to version 1.11.2.\nThe vulnerability is caused by an integer underflow when processing the a=crypto attribute from an inbound SDP request.\nUnauthenticated attackers can trigger this condition on the default external profile by providing a specially crafted SDP payload.\nThe vulnerability allows for remote memory corruption, which can lead to a crash of the entire FreeSWITCH process and subsequent Denial of Service (DoS) for all active telecommunications.\nWhile remote code execution (RCE) has not been demonstrated, the memory corruption potential poses a significant security risk.\nImpacted systems include any FreeSWITCH deployment running versions prior to 1.11.2 where the SDES-SRTP parser is reachable.\nMitigation involves upgrading to version 1.11.2 or disabling the vulnerable media path via configuration changes if immediate patching is not possible.",
  "technicalDetails": "The vulnerability resides within the switch_core_media_add_crypto() function, which handles the parsing of SDES-SRTP key and salt parameters transmitted via SDP a=crypto attributes.\nThe root cause is an integer underflow occurring during the calculation of the destination buffer capacity passed to the switch_b64_decode() function. Specifically, the function incorrectly uses the encoded key and salt length directly from the attacker-supplied SDP without adequate validation. When a zero-length key or salt is provided, the arithmetic leads to an underflow, causing the capacity check to fail or behave unexpectedly.\nThis underflow allows the decoded attribute data to exceed the boundaries of a fixed-size stack buffer. Because the length parameter is incorrectly handled, the decoder writes attacker-controlled bytes past the intended stack allocation, resulting in a classic stack-based buffer overflow.\nThe attack flow begins with an unauthenticated caller sending a crafted SIP INVITE or update request containing a malicious a=crypto attribute to the FreeSWITCH external profile. The SDP parser processes this attribute before the call is answered. In configurations where rtp_secure_media_inbound is enabled, the code path is reached immediately. For profiles requiring authentication, the attacker must possess valid credentials to reach the vulnerable parser logic.\nUpon successful overflow of the stack buffer, the process memory is corrupted. The immediate technical consequence observed is the termination of the FreeSWITCH process, resulting in a total loss of service for all active calls handled by that process instance. WebRTC DTLS-SRTP connections are explicitly noted as unaffected by this vulnerability due to the different processing path for those media types.\nWhile the current analysis identifies the vulnerability as a primary vector for Denial of Service, the ability to overwrite stack contents suggests that, depending on compiler protections and memory layout, advanced exploitation techniques could potentially achieve control flow redirection."
}