{"affected":[{"product":"freeswitch","source":"CNA: GitHub_M","vendor":"signalwire","versions":[{"status":"affected","version":"< 1.11.2"}]}],"cveId":"CVE-2026-116574","cwes":["CWE-193","CWE-787"],"description":"FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_xml_ampencode() reserved only ten bytes for the widest numeric character reference produced from a four-byte UTF-8 sequence, omitting space for the terminating NUL. When remote-supplied text was serialized at the exact buffer-growth boundary, the terminator wrote one byte beyond the heap allocation. Reachable surfaces include mod_xml_cdr, conference and formatted CDR XML, XML Event Socket output, and XML API output that serializes caller-controlled values. The fixed zero-byte write can abort the process or truncate an adjacent object, while remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.","epss":{"date":"2026-11-09","percentile":0.32137,"score":0.00379},"exploits":[],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},{"score":5.9,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","version":"3.1"}],"modifiedAt":1794266232803,"publishedAt":1793905226440,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-r6vh-qmwm-h3cc"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/signalwire/freeswitch/commit/28fcfd26246c112fa4b9e698433d09e4836ca1b5"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/signalwire/freeswitch/commit/28fcfd26246c112fa4b9e698433d09e4836ca1b5"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-r6vh-qmwm-h3cc"}],"remediation":[],"revision":"89585c46fb2ce3994eb6cb83a84f1962b965d5125d8713e4222e955c3b992574","sources":[{"modifiedAt":1794263953986,"name":"CNA: GitHub_M","retrievedAt":1794265722542,"url":"https://www.cve.org/CVERecord?id=CVE-2026-116574"},{"modifiedAt":1794266232803,"name":"NVD","retrievedAt":1794269889415,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116574"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794265728629,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116574"}],"ssvc":{"assessedAt":1794263943378,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"FreeSWITCH: Off-by-one heap write in core XML serialization of four-byte UTF-8 sequences","updatedAt":1794269889415}