Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_event_expand_headers_check() advanced beyond its heap copy when a positive offset in ${variable:offset} exceeded the variable value's length. The following length calculation and copy appended adjacent heap memory to the expansion result, potentially exposing channel variables, credentials, allocator data, and pointer bytes. The flaw is reachable through configuration templates that slice remote input and through authenticated Event Socket eval or Event Socket expand commands; the separate channel-variable expander used by ordinary dialplan slicing is unaffected. The requester cannot choose adjacent memory and disclosure stops at a zero byte, but repeated expansion can influence the layout. This issue is fixed in version 1.11.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-11-05T20:17:44.943Z",
  "pubdate": "2026-11-05T20:17:44.943Z",
  "executiveSummary": "A heap out-of-bounds read vulnerability exists in FreeSWITCH prior to version 1.11.2, stemming from an improper handling of variable expansion offsets within the switch_event_expand_headers_check() function.\nThe vulnerability allows for the disclosure of sensitive heap memory contents, including channel variables, credentials, allocator metadata, and raw pointer addresses, by specifying an offset that exceeds the length of a target variable.\nSuccessful exploitation requires the ability to influence configuration templates or access authenticated Event Socket eval or expand commands.\nWhile an attacker cannot select specific adjacent memory regions and the disclosure terminates upon encountering a null byte, the exploitability is enhanced through heap grooming, where repeated expansion operations influence memory layout.\nThis flaw presents a significant risk to telecom infrastructure, as it enables the extraction of sensitive information that could lead to further system compromise or unauthorized access to communication streams.",
  "technicalDetails": "The root cause of this vulnerability lies in the logic of the switch_event_expand_headers_check() function, which fails to correctly validate the offset parameter provided in the ${variable:offset} syntax. Specifically, when the provided positive offset is numerically greater than the total length of the associated variable value, the internal pointer logic advances beyond the allocated bounds of the heap buffer.\nFollowing this boundary violation, the function performs a length calculation based on the offset and proceeds to copy memory contents. Because the bounds check is insufficient, the operation appends contiguous heap memory following the legitimate variable buffer to the expansion result. This results in an out-of-bounds read, returning unintended heap data to the attacker.\nThe attack flow typically involves an attacker injecting malicious variable expansion sequences. This can be achieved through configuration templates that process remote input or by invoking the Event Socket eval or expand commands. While ordinary dialplan slicing via the separate channel-variable expander remains unaffected, the targeted interface allows for high-frequency interaction with the vulnerable logic.\nAlthough the disclosure is naturally constrained by the presence of null bytes (0x00) in the heap, an attacker can perform heap grooming. By systematically triggering repeated expansion requests, the attacker can influence the allocator's state and the arrangement of objects in memory. This improves the probability of placing sensitive data (such as authentication credentials or pointer bytes) immediately following the target variable buffer, thereby facilitating a more reliable data exfiltration process.\nThis vulnerability affects FreeSWITCH versions prior to 1.11.2. The lack of proper length validation during the slicing operation turns a standard string manipulation utility into an information disclosure primitive, exposing the internal memory state of the telephony stack to authenticated or indirectly influenced actors."
}