{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-116574","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-10-26T15:03:39.034Z","datePublished":"2026-11-05T19:00:26.440Z","dateUpdated":"2026-11-05T19:00:26.440Z"},"containers":{"cna":{"title":"FreeSWITCH: Off-by-one heap write in core XML serialization of four-byte UTF-8 sequences","problemTypes":[{"descriptions":[{"cweId":"CWE-193","lang":"en","description":"CWE-193: Off-by-one Error","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-787","lang":"en","description":"CWE-787: Out-of-bounds Write","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","version":"3.1"}}],"references":[{"name":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-r6vh-qmwm-h3cc","tags":["x_refsource_CONFIRM"],"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-r6vh-qmwm-h3cc"},{"name":"https://github.com/signalwire/freeswitch/commit/28fcfd26246c112fa4b9e698433d09e4836ca1b5","tags":["x_refsource_MISC"],"url":"https://github.com/signalwire/freeswitch/commit/28fcfd26246c112fa4b9e698433d09e4836ca1b5"},{"name":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2","tags":["x_refsource_MISC"],"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2"}],"affected":[{"vendor":"signalwire","product":"freeswitch","versions":[{"version":"< 1.11.2","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-11-05T19:00:26.440Z"},"descriptions":[{"lang":"en","value":"FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_xml_ampencode() reserved only ten bytes for the widest numeric character reference produced from a four-byte UTF-8 sequence, omitting space for the terminating NUL. When remote-supplied text was serialized at the exact buffer-growth boundary, the terminator wrote one byte beyond the heap allocation. Reachable surfaces include mod_xml_cdr, conference and formatted CDR XML, XML Event Socket output, and XML API output that serializes caller-controlled values. The fixed zero-byte write can abort the process or truncate an adjacent object, while remote code execution has not been demonstrated. This issue is fixed in version 1.11.2."}],"source":{"advisory":"GHSA-r6vh-qmwm-h3cc","discovery":"UNKNOWN"}}}}