Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, msrp_parse_buffer() subtracted delimiter framing from a peer-controlled short segment whose MSRP byte range ended in * without first proving the segment was long enough. The unsigned result wrapped near SIZE_MAX and reached switch_msrp_msg_set_payload() as both an allocation size and memcpy length, while related pointer arithmetic could read before the receive buffer. The listener is disabled by default in msrp.conf.xml, but any deployment enabling an MSRP TCP or TLS port parses this framing before authentication. An unauthenticated network peer can corrupt memory and crash FreeSWITCH, dropping all active calls, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-05T20:17:44.153Z",
  "pubdate": "2026-11-05T20:17:44.153Z",
  "executiveSummary": "FreeSWITCH versions prior to 1.11.2 are susceptible to an integer underflow vulnerability within the msrp_parse_buffer() function. This flaw originates from improper boundary validation when processing MSRP delimiter framing in peer-controlled data segments.\nThe vulnerability allows an unauthenticated, remote network peer to trigger an integer wrap-around by sending a specially crafted, short MSRP segment ending in an asterisk. This results in an excessively large value being passed to switch_msrp_msg_set_payload() for memory allocation and subsequent memcpy operations.\nSuccessful exploitation leads to memory corruption and service instability, resulting in a denial-of-service (DoS) condition that terminates all active calls. While remote code execution (RCE) has not been demonstrated, the memory corruption primitives pose a significant risk to service availability.\nThe vulnerability is reachable if an MSRP TCP or TLS port is explicitly enabled in msrp.conf.xml, as the parsing logic executes prior to any authentication protocols. Deployment of this stack in exposed environments without the fix constitutes a high risk, necessitating immediate updates.",
  "technicalDetails": "The root cause of the vulnerability lies in the msrp_parse_buffer() function, which fails to perform adequate length verification before executing pointer arithmetic and subtraction operations on MSRP delimiter framing data. Specifically, when the function processes an MSRP segment where the byte range terminates with an asterisk, it subtracts the framing length from the peer-supplied segment length without first ensuring that the segment is of sufficient size.\nThis arithmetic oversight results in an integer underflow when the segment length is smaller than the framing length. Because the resulting value is unsigned, it wraps around to a value near SIZE_MAX. This wrapped value is subsequently propagated to switch_msrp_msg_set_payload(), where it is utilized as both the allocation size for dynamic memory and as the length parameter for a subsequent memcpy operation. Furthermore, the incorrect pointer arithmetic allows the function to perform out-of-bounds reads before the beginning of the receive buffer.\nThe attack flow proceeds as follows: 1) The attacker initiates a connection to an enabled MSRP TCP or TLS port within the FreeSWITCH instance. 2) The attacker transmits a malicious MSRP segment specifically crafted to trigger the underflow in msrp_parse_buffer()—namely, a short segment ending in an asterisk. 3) The parsing logic, executing pre-authentication, calculates an erroneous, near-maximum length due to the integer wrap-around. 4) The system attempts to allocate a memory buffer based on this overflowed value and performs an out-of-bounds copy or memory access. 5) This interaction results in memory corruption, leading to a crash of the FreeSWITCH process.\nThe exposure is dependent on the configuration; while the listener is disabled by default, deployments that explicitly enable MSRP functionality are inherently vulnerable to unauthenticated remote exploitation. Because this processing happens before any authentication handshake, the vulnerability provides a vector for remote attackers to disrupt telecom services, drop all current calls, and force a restart of the stack. Although no RCE vector has been validated, the ability to induce arbitrary heap manipulation or process termination represents a critical threat to service integrity and availability."
}