CVE-2026-116788

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.2

Description An integer underflow in the switch xml decode() function occurs when an XML document declares an entity with an empty replacement value, leading to an undersized heap allocation. A subsequent copying operation overruns the allocated buffer. An unauthenticated attacker can trigger this issue by sending a crafted SIP PUBLISH request to a SIP profile that has presence management enabled and permits DTD (Document Type Definition) processing. Successful exploitation can corrupt heap memory and terminate the process, resulting in the interruption of all active calls.

Recommendations Update to version 1.11.2.