Description

FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in  switch_xml_decode()  can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-11-05T20:17:46.240Z",
  "pubdate": "2026-11-05T20:17:46.240Z",
  "executiveSummary": "This vulnerability involves an integer underflow flaw within the switch_xml_decode() function in FreeSWITCH, specifically affecting versions prior to 1.11.2.\nThe flaw allows an unauthenticated, remote attacker to trigger an undersized heap allocation by crafting an XML document that utilizes an entity with an empty replacement value.\nExploitation of this vulnerability leads to a heap-based buffer overflow during the subsequent memory copy operation.\nThe primary impact of a successful exploit is the corruption of heap memory and the abnormal termination of the FreeSWITCH process, resulting in a denial-of-service (DoS) condition that terminates all active telecommunications sessions.\nSuccessful exploitation requires that the target FreeSWITCH instance has a SIP profile with both presence management enabled and DTD processing permitted, allowing the attacker to reach the vulnerable code path via a crafted SIP PUBLISH request.",
  "technicalDetails": "The vulnerability resides in the switch_xml_decode() function, which handles the parsing and decoding of XML entities. The root cause is an integer underflow condition triggered when processing an entity definition that contains an empty replacement value.\nWhen the XML parser encounters such an entity, the calculation determining the size of the memory buffer to be allocated on the heap fails to account for the empty replacement correctly, resulting in an undersized allocation.\nThe exploitation flow begins with the attacker sending a specially crafted SIP PUBLISH request to a FreeSWITCH server. For the exploit to reach the vulnerable function, the target must have the SIP profile configured with presence management features enabled and DTD (Document Type Definition) processing allowed.\nOnce the malicious XML payload is processed, the switch_xml_decode() function allocates an insufficient amount of heap memory based on the erroneous integer calculation. Following this allocation, the system proceeds to perform a copy operation of the XML content into the newly allocated heap buffer.\nBecause the buffer is smaller than the data being copied, a heap-based buffer overflow occurs. This overflow allows for the corruption of adjacent heap metadata or subsequent data structures in memory.\nThe immediate post-exploitation behavior is the instability of the application, typically resulting in a segmentation fault or a process crash. This effectively interrupts all ongoing telecommunications traffic handled by the affected FreeSWITCH process, leading to a service-wide disruption.\nThe vulnerability affects FreeSWITCH versions prior to 1.11.2. The attack is executable by an unauthenticated party over the network, provided the specific SIP profile conditions are met.\nAdvanced exploitation could theoretically permit arbitrary code execution if the heap layout can be precisely manipulated, though the primary observed impact is system termination via memory corruption."
}