Description

FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 until 1.11.1, a stack-based buffer overflow in  mod_sofia  when generating dialog-event notifications. A peer can establish a dialog with an excessively long SIP To-header user part and subsequently subscribe to that entity’s dialog events, causing the stored value to overflow a fixed-size stack buffer. Exploitation requires presence or shared-appearance management to be enabled and normally requires valid profile credentials, unless subscription authentication is disabled. The overflow can terminate the FreeSWITCH process and all active calls. This vulnerability is fixed in version 1.11.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-05T19:17:10.917Z",
  "pubdate": "2026-11-05T19:17:10.917Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified within the mod_sofia module of the FreeSWITCH telecommunications platform, specifically affecting versions 1.10.0 through 1.11.1.\nThe vulnerability resides in the dialog-event notification generation process, where an attacker can trigger memory corruption by providing an excessively long SIP To-header user component.\nSuccessful exploitation results in the abnormal termination of the FreeSWITCH process, leading to a complete Denial of Service (DoS) condition for all active calls and telecommunications infrastructure.\nThe attack vector involves the establishment of a dialog followed by a subscription to dialog events. In environments where presence or shared-appearance management is active, this vulnerability presents a significant risk to service availability.\nWhile exploitation typically requires valid profile credentials to authenticate the SIP subscription, the risk is elevated in configurations where subscription authentication is explicitly disabled.\nOrganizations relying on FreeSWITCH are encouraged to update to version 1.11.2 or later to eliminate the underlying flaw.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow occurring within the mod_sofia module, which is responsible for the platform's SIP (Session Initiation Protocol) signaling capabilities. The root cause is improper bounds checking during the processing of dialog-event notifications.\nThe flaw specifically manifests when the system handles SIP To-header user components. When a SIP peer initiates a dialog with a malformed, excessively long user part and subsequently executes a subscription request for dialog events, the application attempts to copy this oversized input into a fixed-size buffer allocated on the stack.\nBecause the input length is not validated or constrained before the copy operation, the memory write exceeds the boundaries of the allocated stack buffer, overwriting adjacent stack memory. This results in the corruption of the function's return address or other critical stack metadata.\nThe attack flow follows a structured sequence: First, the attacker establishes a SIP dialog with the target FreeSWITCH instance. Second, the attacker crafts a malicious packet containing a SIP To-header with a user-part payload designed to exceed the internal buffer's capacity. Third, the attacker initiates a subscription to the dialog events for this entity. Upon processing the subscription, the mod_sofia module attempts to store the user-part value, triggering the overflow.\nExploitation requirements include the enabled state of presence or shared-appearance management features within the FreeSWITCH configuration. In standard deployment scenarios, the attacker requires valid credentials to authenticate against the SIP profile. However, if the platform is configured with authentication disabled for subscriptions—a common misconfiguration in internal or trusted environments—the attack surface is significantly increased, allowing for unauthenticated remote exploitation.\nThe post-exploitation impact is a catastrophic service disruption. Due to the corruption of the stack, the FreeSWITCH process experiences a segmentation fault and terminates abruptly. This results in the immediate loss of all active signaling and media processing, rendering the telecommunications gateway incapable of handling calls until the service is manually restarted by administrative personnel."
}