Yüksek CVSS 8.2
CVE-2026-116788: CVE-2026-116788: yığın (heap) taşması
Açıklama (NVD)
FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in switch_xml_decode() can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.
Özet bilgiler
- CVSS v3.1
- 8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - EPSS
- %0,41 (yüzdelik 35)
- CWE
- CWE-122
- Yama
- Yok / bilinmiyor