Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, ws_read_frame() decoded a WebSocket frame's 64-bit extended payload length with a 32-bit byte swap and narrowed the result into a signed length. A value whose surviving low word became negative bypassed the signed size check and was reinterpreted as an enormous unsigned count, causing client bytes to overwrite memory beyond the 64 KiB receive buffer. Any client completing a /socket WebSocket upgrade on an enabled mod_xml_rpc endpoint reached the parser before HTTP authentication; both the module and WebSocket endpoint are disabled by default. The heap overwrite can corrupt connection pointers and crash FreeSWITCH, ending every concurrent session, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-11-05T20:17:45.730Z",
  "pubdate": "2026-11-05T20:17:45.730Z",
  "executiveSummary": "FreeSWITCH versions prior to 1.11.2 contain a heap-based buffer overflow vulnerability within the WebSocket frame processing logic.\nThe vulnerability arises from improper handling of 64-bit extended payload lengths during the decoding process in the ws_read_frame() function.\nBy manipulating the payload length field of a WebSocket frame, an unauthenticated remote attacker can trigger a memory corruption event.\nAlthough the module and WebSocket endpoint are disabled by default, if enabled, the vulnerability is reachable before HTTP authentication occurs.\nSuccessful exploitation results in the corruption of connection pointers and potential service disruption, causing all concurrent sessions to crash.\nWhile remote code execution has not been explicitly demonstrated, the potential for heap metadata corruption poses a significant stability and security risk to affected telecom infrastructure.",
  "technicalDetails": "The root cause of the vulnerability exists in the ws_read_frame() function, which is responsible for parsing incoming WebSocket frames. The implementation incorrectly handles the 64-bit extended payload length field. Specifically, the function performs a 32-bit byte swap on the 64-bit value and subsequently narrows the result into a signed integer type.\nDuring the parsing phase, if an attacker provides a crafted WebSocket frame where the 64-bit extended payload length has a high-order bit set such that the resulting low-word interpretation becomes negative, the logic bypasses the established signed size check. This leads to a critical type confusion where the narrowed, signed negative value is reinterpreted as an enormous unsigned integer by subsequent memory management or buffer copy operations.\nThe attack flow initiates when a client establishes a /socket WebSocket upgrade on an enabled mod_xml_rpc endpoint. Because this specific code path is reached prior to the invocation of HTTP authentication handlers, an attacker does not require valid credentials to trigger the vulnerability. Once the parser processes the malicious frame, the system performs a heap overwrite, copying attacker-controlled bytes beyond the allocated 64 KiB receive buffer.\nThe overflow facilitates the corruption of adjacent heap memory, including critical connection structures and pointers used by the FreeSWITCH engine. This memory corruption typically leads to a process crash, which results in a complete denial-of-service for all concurrent sessions handled by the affected instance. The vulnerability affects FreeSWITCH versions prior to 1.11.2. The exploitation requires the target to have the mod_xml_rpc module and the associated WebSocket endpoint enabled, which are not active in a default, hardened configuration."
}