CVE-2026-116569

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.2

Description The msrp parse buffer() function fails to verify if a peer-controlled short segment is sufficiently long before subtracting delimiter framing when the MSRP byte range ends in *. This causes an unsigned result to wrap near SIZE MAX, which is then passed to switch msrp msg set payload() as both an allocation size and memcpy length. Additionally, pointer arithmetic may lead to reading memory before the receive buffer. An unauthenticated network peer can exploit this by sending specially crafted framing to an enabled MSRP TCP or TLS port to corrupt memory and crash the system, resulting in the loss of all active calls.

Recommendations Update to version 1.11.2. As a temporary mitigation, ensure the listener remains disabled in msrp.conf.xml or restrict access to the MSRP TCP and TLS ports.