Description

FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 to 1.11.1, there is a stack-based buffer overflow in  mod_sofia  when processing SIP Contact display names for dialog-event notifications. A peer can establish a dialog containing an excessively long display name and subsequently subscribe to that entity’s dialog events, causing the stored value to overflow a fixed 512-byte stack buffer. Exploitation requires presence management to be enabled, directly or through shared appearance, and normally requires valid profile credentials unless subscription authentication is disabled. The overflow can terminate the FreeSWITCH process and all active calls. This vulnerability is fixed in version 1.11.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-05T20:17:44.627Z",
  "pubdate": "2026-11-05T20:17:44.627Z",
  "executiveSummary": "This vulnerability involves a stack-based buffer overflow in the mod_sofia module of FreeSWITCH, affecting versions 1.10.0 through 1.11.1.\nThe flaw occurs during the processing of SIP Contact display names associated with dialog-event notifications.\nBy submitting a maliciously crafted, excessively long display name, an attacker can trigger a stack buffer overflow within a fixed 512-byte buffer.\nThe successful exploitation of this vulnerability results in a process crash, leading to a denial-of-service condition that terminates the FreeSWITCH application and disconnects all active telecommunications sessions.\nThe risk is critical for environments where system availability is paramount, as it allows unauthorized interruption of telephony services.\nExploitation requires presence management to be active (either directly or via shared appearance).\nIn standard deployments, the attacker typically requires valid profile credentials to authenticate the subscription, though the risk increases significantly if subscription authentication is disabled or misconfigured.",
  "technicalDetails": "The root cause of the vulnerability resides in the mod_sofia module, which handles SIP signaling and media processing. When FreeSWITCH processes dialog-event notifications, it must handle the SIP Contact header, which includes a display name field.\nThe application utilizes a fixed-size stack buffer of 512 bytes to store this display name string. The parsing logic fails to implement adequate bounds checking before copying the incoming display name data into this static stack allocation.\nAn attacker initiates the attack by establishing a SIP dialog or participating in a session where the Contact display name is manipulated. The attacker provides a payload exceeding 512 bytes, which triggers a memory corruption event when the application attempts to copy the data into the stack buffer.\nThe attack flow follows these steps: 1) The attacker connects to the target FreeSWITCH instance, typically requiring valid credentials unless security policies are lax. 2) The attacker initiates a dialog-event subscription request targeting a specific entity. 3) The attacker injects a SIP Contact header containing a payload significantly longer than 512 bytes. 4) The mod_sofia module processes the notification, copying the malicious string into the vulnerable stack buffer without size verification. 5) The stack memory surrounding the buffer is overwritten, leading to the corruption of stack metadata or the instruction pointer.\nBecause the vulnerability involves a stack-based buffer overflow, the primary immediate impact is the corruption of the process execution context, resulting in an unhandled exception and the termination of the FreeSWITCH process. This constitutes a persistent denial-of-service for all users and services handled by the instance.\nThe vulnerability is restricted to versions 1.10.0 through 1.11.1. The flaw is specifically tied to the processing logic within mod_sofia related to the presence management subsystem. Environments that do not utilize presence management or shared appearance features may reduce their attack surface, though the module remains vulnerable if loaded.\nPost-exploitation, the immediate result is a process crash. While stack overflows can theoretically lead to arbitrary code execution, the primary documented impact in this context is the disruption of service through process termination."
}