CVE-2026-116785

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.2

Description The ws read frame() function incorrectly decodes a WebSocket frame's 64-bit extended payload length using a 32-bit byte swap and narrows the result into a signed length. This allows a value that becomes negative to bypass signed size checks and be reinterpreted as a large unsigned count, leading to a heap overwrite beyond the 64 KiB receive buffer. This occurs when a client completes a /socket WebSocket upgrade on an enabled mod xml rpc endpoint, which is reached before HTTP authentication. While remote code execution has not been demonstrated, the heap overwrite can corrupt connection pointers and crash the system, terminating all concurrent sessions. Both the mod xml rpc module and the WebSocket endpoint are disabled by default.

Recommendations Update to version 1.11.2. Disable the mod xml rpc module or the WebSocket endpoint to minimize the risk of exploitation.