https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-11T19:54:39.284787+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-116788 CVE-2026-116788 — FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding 2026-11-11T19:54:39.286250+00:00

Affected: signalwire freeswitch

FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in  switch_xml_decode()  can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.