# CVE-2026-115928: FreeSWITCH stack buffer overflow in SDES-SRTP parser

Source: https://junglewise.ai/threats/cve-2026-115928-freeswitch-is-a-software-defined-telecom-stack-enabling-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-115928 · Severity: high · CVSS 7.5 · Published 2026-11-05

FreeSWITCH is a software-based telephone system that processes voice calls and media encryption setup. An unauthenticated remote attacker can send a specially crafted call setup message that causes a memory corruption in the encryption key parsing code, crashing the entire system and disconnecting all active calls. The vulnerability requires the system to accept unauthenticated SIP calls and use SDES-SRTP encryption.

Technologies: [SignalWire FreeSWITCH](https://junglewise.ai/threats/technologies/freeswitch). Vendors: [SignalWire](https://junglewise.ai/threats/vendors/signalwire).

## Quick answers

**Is CVE-2026-115928 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115928 being exploited in the wild.

**How severe is CVE-2026-115928?** High severity, with a CVSS score of 7.5, published 5 November 2026.

**Which products and versions are affected?** SignalWire FreeSWITCH before 1.11.2.

**Is there a fix for CVE-2026-115928?** Yes: fixed in 1.11.2. Until then: Set rtp_secure_media_inbound to false to disable the SDES-SRTP parsing path, or restrict inbound calls to authenticated senders only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115928 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-115928?** Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.11.2

Set rtp_secure_media_inbound to false to disable the SDES-SRTP parsing path, or restrict inbound calls to authenticated senders only.

## Technical details

The switch_core_media_add_crypto() function in the SDP crypto attribute parser accepts a key-salt length value from an inbound a=crypto attribute and passes it as a buffer capacity to switch_b64_decode(). When the parsed key-salt is zero-length, the capacity underflows, permitting a stack buffer overflow with attacker-controlled decoded bytes. The vulnerability affects the SDES-SRTP path reachable by unauthenticated callers on default external profiles; callers who authenticate, or systems using WebRTC DTLS-SRTP, are unaffected. Memory corruption causes process crash and call dropping; RCE is not demonstrated.

## Affected products

- SignalWire FreeSWITCH before 1.11.2

## Timeline

- 2026-11-05: advisory: CVE-2026-115928 published

## References

- [https://github.com/signalwire/freeswitch/commit/86b10358e2a191e2daff33d97c32757d43c8f92f](https://github.com/signalwire/freeswitch/commit/86b10358e2a191e2daff33d97c32757d43c8f92f)
- [https://github.com/signalwire/freeswitch/releases/tag/v1.11.2](https://github.com/signalwire/freeswitch/releases/tag/v1.11.2)

## Related threats

- [FreeSWITCH ICE integrity validation bypass](https://junglewise.ai/threats/cve-2026-116790-freeswitch-is-a-software-defined-telecom-stack-enabling-the)
- [FreeSWITCH DTLS fingerprint validation bypass in server role](https://junglewise.ai/threats/cve-2026-116789-freeswitch-is-a-software-defined-telecom-stack-enabling-the)
- [FreeSWITCH integer underflow in XML decode](https://junglewise.ai/threats/cve-2026-116788-freeswitch-is-an-open-source-software-telecommunications)
- [FreeSWITCH mod_event_socket denial of service via Content-Length](https://junglewise.ai/threats/cve-2026-116787-freeswitch-is-a-software-defined-telecom-stack-enabling-the)
- [FreeSWITCH command injection via SIP REFER URI parameters](https://junglewise.ai/threats/cve-2026-116786-freeswitch-is-a-software-defined-telecom-stack-enabling-the)