Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_xml_ampencode() reserved only ten bytes for the widest numeric character reference produced from a four-byte UTF-8 sequence, omitting space for the terminating NUL. When remote-supplied text was serialized at the exact buffer-growth boundary, the terminator wrote one byte beyond the heap allocation. Reachable surfaces include mod_xml_cdr, conference and formatted CDR XML, XML Event Socket output, and XML API output that serializes caller-controlled values. The fixed zero-byte write can abort the process or truncate an adjacent object, while remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-11-05T19:17:11.200Z",
  "pubdate": "2026-11-05T19:17:11.200Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability exists in FreeSWITCH prior to version 1.11.2, stemming from an off-by-one error during string serialization in the switch_xml_ampencode() function.\nThe vulnerability occurs when processing four-byte UTF-8 sequences, where the allocated buffer size fails to account for the terminating null byte at the precise boundary of the heap allocation.\nThis flaw allows a remote, unauthenticated attacker to trigger a memory corruption event by providing malicious input that is subsequently processed by XML-based components.\nImpacts include the potential for process termination (Denial of Service) or the corruption of adjacent heap objects.\nWhile remote code execution has not been explicitly demonstrated, the ability to manipulate heap metadata or adjacent objects poses a significant security risk to the stability and integrity of the telecom stack.\nAffected surfaces include mod_xml_cdr, conference modules, XML Event Socket, and XML API interfaces that serialize caller-controlled data.",
  "technicalDetails": "The root cause of this vulnerability is an insufficient buffer allocation logic within the switch_xml_ampencode() function in FreeSWITCH versions prior to 1.11.2. The function was designed to reserve ten bytes to accommodate the serialization of a four-byte UTF-8 sequence into a numeric character reference. However, the implementation neglected to allocate sufficient space for the mandatory NUL ('\\0') terminator.\nWhen the input processing reaches the boundary of a heap-allocated buffer, the serialization routine attempts to append the terminating NUL byte. Because the buffer was undersized by one byte, this operation performs an out-of-bounds write, overwriting the first byte of the adjacent memory chunk on the heap.\nThe exploitation flow initiates when a remote user supplies crafted input to any of the exposed surfaces that utilize switch_xml_ampencode(), such as mod_xml_cdr, conference-related XML output, or XML Event Socket streams. The attacker specifically targets the exact buffer-growth boundary, triggering the memory allocation and subsequent serialization process.\nUpon reaching this boundary, the process performs an out-of-bounds write of a zero byte (the NUL terminator). The immediate impact of this write is dependent on the heap layout at the time of execution. If the corrupted heap object is currently in use, the process may experience an unexpected state change, leading to either an immediate crash (Denial of Service) or the corruption of object member variables, which could lead to unpredictable application behavior or data truncation.\nBecause the vulnerability involves heap memory manipulation, it is subject to the conditions of the process's allocator and the existing heap fragmentation. Although no remote code execution vector has been established, the ability to influence heap state makes this a high-severity concern for infrastructure stability. There are no authentication requirements to trigger this vulnerability, as the affected interfaces are reachable via the exposed network protocols used by FreeSWITCH."
}