CVE-2026-116574

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_xml_ampencode() reserved only ten bytes for the widest numeric character reference produced from a four-byte UTF-8 sequence, omitting space for the terminating NUL. When remote-supplied text was serialized at the exact buffer-growth boundary, the terminator wrote one byte beyond the heap allocation. Reachable surfaces include mod_xml_cdr, conference and formatted CDR XML, XML Event Socket output, and XML API output that serializes caller-controlled values. The fixed zero-byte write can abort the process or truncate an adjacent object, while remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.

• CWE-193
• CWE-787

• https://github.com/signalwire/freeswitch/commit/28fcfd26246c112fa4b9e698433d09e4836ca1b5
• https://github.com/signalwire/freeswitch/releases/tag/v1.11.2
• https://github.com/signalwire/freeswitch/security/advisories/GHSA-r6vh-qmwm-h3cc

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116557The WP Booking System - Booking Calendar plugin for WordPres…9.1
• CVE-2026-11656Use after free in ServiceWorker in Google Chrome prior to 14…8.3
• CVE-2026-116563The Photo Gallery, Sliders, Proofing and Themes – NextGEN Ga…5.4
• CVE-2026-116566socket.getaddrinfo() previously accepted null bytes within *…5.3
• CVE-2026-11657Use after free in Payments in Google Chrome on Mac prior to …8.8
• CVE-2026-116573FreeSWITCH is an open-source software telecommunications pla…6.5
• CVE-2026-116575Mem0 provides persistent memory infrastructure for AI agents…6.3
• CVE-2026-116576systeminformation is a System and OS information library for…7.8
• CVE-2026-116577Tornado is a Python web framework and asynchronous networkin…5.3
• CVE-2026-116578Tornado is a Python web framework and asynchronous networkin…2.1
• CVE-2026-116579Autobahn Python is a WebSocket and WAMP implementation for P…5.9
• CVE-2026-11658Insufficient validation of untrusted input in Extensions in …6.5