CVE-2026-116780

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.2

Description The switch event expand headers check() function fails to properly validate the offset in ${variable:offset} when it exceeds the length of the variable value. This allows the system to read beyond the heap copy, appending adjacent heap memory to the expansion result. This behavior can expose sensitive information such as channel variables, credentials, allocator data, and pointer bytes. The issue is reachable via configuration templates that slice remote input and through authenticated Event Socket eval or Event Socket expand commands.

Recommendations Update to version 1.11.2.