External risk intelligence

FreeSWITCH WebSocket Heap Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-116785

The vulnerability exists in a WebSocket parser within a telecom stack. While it is network-reachable, the affected endpoint and module are disabled by default in standard deployments, requiring explicit configuration to enable. Because the vulnerable component is not active in a default installation, public internet exposure is uncommon for most deployments.

Out-of-bounds Write

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in FreeSWITCH, a software telecom stack. A flaw in how the system handles WebSocket data can lead to memory corruption, potentially crashing the service and disrupting all active connections. While remote code execution has not been proven, the service disruption is a significant concern.

Flaw can crash telecom software.
Disrupts all active connections.
Confirm if this telecom software is used.

Attack Path

How an attacker could exploit the issue

An attacker could target this vulnerability by completing a WebSocket upgrade request to an enabled XML-RPC endpoint. This would allow them to send specially crafted client bytes to the `ws_read_frame()` function. The function's handling of extended payload lengths could then lead to memory corruption. While remote code execution is not demonstrated, the vulnerability can cause FreeSWITCH to crash, disrupting all active connections.

No authentication or user interaction needed.
Triggered by crafted WebSocket frame.
Disrupts service, potential memory corruption.

Live Threat

Current exploitation, exposure, and threat context

When the `mod_xml_rpc` module and WebSocket endpoint are enabled, an attacker could exploit this vulnerability to overwrite memory beyond the receive buffer by completing a WebSocket upgrade. This could lead to crashes and disruption of service.

System stability and availability.
Memory corruption via crafted WebSocket frames.
Service crashes and session termination.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership of this issue likely falls to the infrastructure or platform teams managing FreeSWITCH, with a strong partnership from network and security teams. The first practical step is to confirm if the `/socket` WebSocket upgrade on an enabled `mod_xml_rpc` endpoint is active, as these are disabled by default. If confirmed, identify the accountable owner and then plan remediation, prioritizing critical or exposed instances.

Platform and infrastructure teams own the issue.
Verify WebSocket and mod_xml_rpc endpoint status.
Plan remediation based on confirmed exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FreeSWITCH?

FreeSWITCH is a software-based telecom stack used to build digital telephony systems. It functions as a replacement for traditional, hardware-heavy telecom switches by allowing voice and data communication services to run on standard server hardware. Organizations use it to manage complex call routing, conferencing, and other real-time media processing tasks.

What is the vulnerability in CVE-2026-116785?

This is a memory corruption flaw, specifically a heap-based buffer overflow. It occurs because the system incorrectly calculates the size of incoming data, leading the software to write information outside of its allocated memory space. This is categorized under weakness classes including improper restriction of operations within memory (CWE-122 and CWE-787) and incorrect conversion between numeric types (CWE-681).

How is this memory overflow triggered?

An attacker triggers the bug by sending a specially crafted WebSocket frame to an active endpoint. The system incorrectly processes the payload length, causing it to overwrite memory. It is important to note that this does not trigger if the mod_xml_rpc module and the specific WebSocket endpoint are disabled, which is the default state for FreeSWITCH.

Do I need to worry about this CVE?

Your level of concern depends on your configuration. According to Halo Surface Signal, the vulnerability is unlikely to be reachable in most standard installations because the affected module and endpoint are disabled by default. You only need to prioritize this if you have manually enabled the mod_xml_rpc module and exposed the WebSocket functionality, making the service reachable over the network.

How should I respond to this threat advisory?

First, verify whether your infrastructure has the mod_xml_rpc module and the associated WebSocket endpoint enabled. If they are disabled, you are not susceptible to this specific path. If you find them enabled, coordinate with your infrastructure or platform teams to update FreeSWITCH to version 1.11.2 or later, which contains the fix for the memory calculation error.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.