Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, udptl_rx_packet() used a peer-controlled FEC entry count directly to fill five-entry FEC arrays in a mod_spandsp T.38 session. A larger count wrote sender-controlled error-recovery data beyond those arrays and persisted the oversized count for a later reconstruction pass. Any peer able to deliver UDPTL to an established T.38 fax session can reach the parser, including deployments using fax applications or a T.38 gateway. The memory corruption can crash FreeSWITCH and end every active call, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-11-05T20:17:45.400Z",
  "pubdate": "2026-11-05T20:17:45.400Z",
  "executiveSummary": "FreeSWITCH versions prior to 1.11.2 contain a critical memory corruption vulnerability within the mod_spandsp module, specifically triggered during T.38 fax session processing. The flaw originates from an improper bounds check in the udptl_rx_packet() function, where peer-controlled input allows for an out-of-bounds write.\nA remote, unauthenticated attacker capable of sending UDPTL packets to an active T.38 fax session can exploit this vulnerability. By providing a crafted FEC (Forward Error Correction) entry count that exceeds the static allocation of the destination array, an attacker can overwrite adjacent memory segments. The primary impact of this vulnerability is a denial-of-service condition, as the memory corruption leads to instability and process crashes, resulting in the termination of all active calls on the affected instance. While remote code execution has not been explicitly demonstrated, the potential for memory corruption introduces significant stability risks and architectural exposure. Organizations utilizing FreeSWITCH for T.38 fax gateways or telephony applications are at risk and should prioritize upgrading to version 1.11.2 or later.",
  "technicalDetails": "The vulnerability resides within the udptl_rx_packet() function in the mod_spandsp module, which handles the processing of UDPTL (UDP Transport Layer) packets used in T.38 fax sessions. The root cause of the issue is an insufficient validation of user-supplied data—specifically, the FEC entry count—before it is utilized in memory write operations.\nIn the affected versions, the implementation defines a fixed-size buffer consisting of a five-entry array intended to store FEC recovery data. The udptl_rx_packet() function fails to perform a bounds check against this hardcoded size when processing incoming UDPTL packets. An attacker can craft a malicious UDPTL packet containing an FEC entry count larger than five. When this value is processed, the function proceeds to write the sender-controlled error-recovery data beyond the designated bounds of the five-entry array.\nThe exploitation flow proceeds as follows: 1) The attacker initiates or intercepts an established T.38 fax session facilitated by FreeSWITCH. 2) The attacker transmits a specifically crafted UDPTL packet containing an excessive FEC entry count field. 3) The udptl_rx_packet() function interprets this count as the loop limit for memory population. 4) The application writes data into heap memory segments adjacent to the FEC array. 5) Furthermore, the application persists this oversized count value for subsequent reconstruction passes, ensuring that the out-of-bounds state is maintained throughout the session lifecycle.\nThe resulting memory corruption typically triggers an immediate application crash, causing a service-wide disruption for all active calls handled by the FreeSWITCH instance. Because the parser is reachable by any entity capable of sending UDPTL traffic to the system, the attack vector is remote and requires no prior authentication or administrative privileges. The inability to safely handle protocol-level inputs directly exposes the underlying process to memory manipulation. Although successful exploitation does not currently leverage the corruption for remote code execution, the ability to induce arbitrary memory writes and process termination constitutes a severe stability and availability vulnerability within the telecommunications stack."
}