SignalWire Patches Three Critical FreeSWITCH Vulnerabilities Including Actively Exploited RCE Flaw
TL;DR
SignalWire disclosed three critical FreeSWITCH vulnerabilities on October 28, 2026, impacting SIP chat handling, WebSocket frame parsing, and ICE media verification. The most severe flaw, CVE-2026-116779 (CVSS 9.8), allows remote command execution via inbound SIP messages and is actively exploited in the wild. VoIP administrators must upgrade their servers to version 1.11.3 and apply configuration changes immediately.
Why It Matters
FreeSWITCH is an open-source, software-defined telecom stack maintained by SignalWire that powers enterprise PBX systems, WebRTC gateways, and carrier switches. While exact global deployment counts are not specified in the advisories, the official FreeSWITCH GitHub repository has over 5,300 stars and 1,900 forks.
According to the official SignalWire FreeSWITCH security advisories, active exploitation of CVE-2026-116779 has already been observed in the wild. By contrast, no active exploitation in the wild has been confirmed for CVE-2026-116785 or CVE-2026-116790, and no public proof-of-concept exploit code has been confirmed for any of the three flaws.
How the Attack Works
These FreeSWITCH vulnerabilities target three distinct components across SIP messaging, XML-RPC WebSockets, and STUN/ICE media handling.
SIP MESSAGE Command Execution: CVE-2026-116779
First, researchers Orn Arnarson and Gunnlaugur reported CVE-2026-116779 (CVSS 9.8). In default configurations where SIP chat is active, sofia_presence_handle_sip_i_message() splits the To user header of an inbound SIP MESSAGE on the + character and uses the left side as a chat protocol selector. Because mod_dptools registers an api chat interface that passes its argument directly to switch_api_execute(), an attacker can run arbitrary FreeSWITCH API and operating system commands. Where mod_lua is loaded, attackers can also execute inline Lua scripts. If a server retains the default passwordless user in conf/vanilla/directory/default/default.xml, unauthenticated attackers can trigger the flaw without credentials.
WebSocket Heap Overflow and ICE Media Hijacking
Second, Tristan Madani of Talence Security discovered CVE-2026-116785 (CVSS 9.1) in mod_xml_rpc. When enable-websocket is active, ws_read_frame() decodes a 64-bit extended payload length using a 32-bit byte swap and stores it as a signed 32-bit integer. If the surviving half has its high bit set, the negative value passes the signed buffer check and triggers an unbounded heap write past the 64 KiB receive buffer before HTTP digest authentication occurs.
Third, Xiangpu Song reported CVE-2026-116790 (CVSS 9.1). In src/switch_rtp.c, FreeSWITCH processes inbound ICE STUN connectivity checks without verifying the HMAC-SHA1 MESSAGE-INTEGRITY attribute. Consequently, an unauthenticated attacker who scans the UDP RTP port range can send a forged Binding Request to redirect call media to their own IP address, causing call drops or plaintext audio eavesdropping.
Affected Versions
These FreeSWITCH vulnerabilities affect all 1.10 and 1.11 releases prior to the patched builds. Specifically, CVE-2026-116785 and CVE-2026-116790 impact versions up to and including 1.11.1, while CVE-2026-116779 affects versions up to and including 1.11.2.
Patch and Mitigation Steps
SignalWire fixed CVE-2026-116785 and CVE-2026-116790 in FreeSWITCH 1.11.2, and resolved CVE-2026-116779 in version 1.11.3 by disabling the api chat protocol by default unless enable-chat-api-proto is set. Furthermore, after upgrading to 1.11.2 or 1.11.3, administrators must manually enable the ice_verify_message_integrity channel variable to enforce STUN HMAC verification. For unpatched servers, operators should set enable-chat=false on SIP profiles, remove passwordless default directory accounts, disable enable-websocket in xml_rpc.conf.xml, and restrict RTP and HTTP ports at the perimeter firewall.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
