CVE-2026-116781

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.2

Description The ws read frame() function incorrectly unmasks WebSocket payloads by iterating wsh->datalen, which includes frame headers, while indexing from the payload pointer. A masked frame that fills the 64 KiB receive buffer can cause an XOR operation to occur up to 14 bytes beyond the buffer, and in cases of exact capacity, a terminating NUL is written one byte out of bounds. This issue is reachable before authentication if mod xml rpc and its opt-in WebSocket endpoint are enabled. These features are disabled by default in the stock configuration. The writes occur within the same connection handle's adjacent outbound buffer.

Recommendations Update to version 1.11.2. Disable the mod xml rpc module and its WebSocket endpoint to mitigate the risk.