Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, ws_read_frame() unmasked a WebSocket payload by iterating wsh->datalen, which included frame headers, while indexing from the payload pointer. A masked frame filling the 64 KiB receive buffer could therefore XOR up to 14 bytes beyond the buffer, and the exact-capacity case also wrote a terminating NUL one byte out of bounds. The flaw is reachable before authentication when mod_xml_rpc and its opt-in WebSocket endpoint are enabled, while both features are disabled in the stock configuration. The writes remain within the same connection handle's adjacent outbound buffer, so neither a process crash nor cross-session disclosure has been demonstrated. This issue is fixed in version 1.11.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-11-05T20:17:45.097Z",
  "pubdate": "2026-11-05T20:17:45.097Z",
  "executiveSummary": "FreeSWITCH versions prior to 1.11.2 contain a critical out-of-bounds write vulnerability within the WebSocket processing logic.\nThe vulnerability resides in the ws_read_frame function, triggered during the unmasking of WebSocket payloads.\nIf the mod_xml_rpc module is enabled with its optional WebSocket endpoint, an unauthenticated remote attacker can supply a specially crafted masked WebSocket frame to induce memory corruption.\nThe flaw occurs because the unmasking process incorrectly utilizes the total frame length, including headers, as the boundary for payload unmasking, resulting in writes beyond the designated 64 KiB receive buffer.\nWhile the specific impact is constrained to adjacent memory within the same connection handle—meaning process crashes or cross-session data leakage have not been demonstrated—the potential for memory corruption remains a significant security concern.\nThe vulnerability is not present in the default stock configuration, as both the required module and the specific WebSocket endpoint must be explicitly enabled by the administrator.\nImmediate remediation involves upgrading to version 1.11.2 or newer, which addresses the incorrect indexing logic.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper boundary calculation within the ws_read_frame function in the FreeSWITCH codebase. The function is responsible for processing incoming WebSocket frames by applying an XOR-based unmasking operation to the payload data.\nThe vulnerability occurs because the function iterates through the data using wsh->datalen, which represents the total length of the WebSocket frame, including the headers. However, the logic proceeds to index from the payload pointer rather than correctly constraining the operation to the actual payload size.\nWhen a masked WebSocket frame is received that fully populates the 64 KiB receive buffer, the flawed iteration logic causes the unmasking loop to extend up to 14 bytes beyond the allocated buffer boundary. Furthermore, a terminating NUL byte is written one byte out-of-bounds when the input frame exactly matches the buffer capacity.\nThe attack flow begins with an attacker establishing a WebSocket connection to the server. If the victim has enabled mod_xml_rpc and configured the opt-in WebSocket endpoint, the attacker can transmit a malicious frame. Since the vulnerability is reachable prior to the authentication phase of the session, no valid credentials are required to trigger the memory write.\nThe payload behavior involves the XOR unmasking mechanism interpreting the header bytes as part of the payload, leading to an incorrect pointer offset. Because these writes occur within the memory space of the adjacent outbound buffer associated with the same connection handle, the scope of the corruption is technically localized.\nWhile current observations indicate that the integrity of the process remains intact and the potential for cross-session information disclosure is limited, the ability to perform arbitrary out-of-bounds writes constitutes a significant software defect that could potentially be leveraged in more complex exploit chains or side-channel scenarios.\nThis vulnerability is restricted to versions prior to 1.11.2. The fix implemented in 1.11.2 corrects the logic by ensuring that the unmasking iteration is strictly bounded by the actual payload length rather than the frame length, preventing the pointer from exceeding the designated memory segment."
}