Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, http_directory_auth() rebuilt an expected user@domain:password credential and base64-encoded it into an 80-byte buffer using an encoder without an output-length argument. A configured credential longer than 57 characters overflowed the stack before the supplied HTTP Basic password was compared. An unauthenticated client only needed to name an existing directory user on an exposed mod_xml_rpc HTTP listener; the module is built but not loaded by the stock configuration. The overflow can corrupt the stack and crash FreeSWITCH, ending every active call, although the overrun bytes come from the configured credential and remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-05T20:17:44.313Z",
  "pubdate": "2026-11-05T20:17:44.313Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability exists in FreeSWITCH versions prior to 1.11.2, specifically within the http_directory_auth() function of the mod_xml_rpc module.\nThe vulnerability occurs due to improper bounds checking during the base64 encoding of user credentials into a fixed-size 80-byte buffer.\nAn unauthenticated attacker can exploit this flaw by targeting an exposed mod_xml_rpc HTTP listener, provided the module is loaded within the environment.\nSuccessful exploitation results in memory corruption on the stack, which leads to the immediate termination of the FreeSWITCH process and all active calls, effectively causing a Denial of Service (DoS).\nWhile remote code execution (RCE) has not been demonstrated, the integrity of the process memory is compromised.\nThe risk is mitigated by the fact that the module is not loaded by default in stock configurations, though environments that have explicitly enabled the module are at risk.",
  "technicalDetails": "The vulnerability resides within the http_directory_auth() function of the mod_xml_rpc module, responsible for handling HTTP Basic authentication requests.\nThe root cause is an unsafe memory operation where the system reconstructs user credentials in the format 'user@domain:password'. This string is subsequently passed to a base64 encoder that lacks an output-length argument to constrain the operation within the allocated memory.\nThe destination for the encoded string is a static, stack-allocated 80-byte buffer. The vulnerability is triggered when the length of the configured credential exceeds 57 characters. Because the encoder does not verify the available space in the destination buffer, it performs an out-of-bounds write, overwriting adjacent stack memory.\nThe exploitation flow begins with an unauthenticated attacker identifying an exposed mod_xml_rpc HTTP listener. The attacker must target an existing directory user account managed by the service. By sending a specially crafted HTTP request, the attacker triggers the authentication routine.\nDuring the execution of http_directory_auth(), the overflow occurs before the HTTP Basic password comparison logic is reached. The data used to overflow the stack is derived from the configured credential itself. Consequently, the memory corruption is highly dependent on the system's current configuration parameters.\nThe primary post-exploitation impact is a crash of the FreeSWITCH service. Because this service manages active telecom calls, the crash results in the immediate disruption of all ongoing sessions across the infrastructure. Although the buffer overflow corrupts the stack, the exploit vector does not currently provide a path to reliable remote code execution (RCE) as the overrun bytes are sourced from the existing configuration. The primary threat remains the potential for mass disruption of telecom services via a Denial of Service (DoS) attack.\nAffected systems include all FreeSWITCH deployments running versions prior to 1.11.2 that have the mod_xml_rpc module active. The vulnerability requires network access to the HTTP listener configured for the XML-RPC interface."
}