Quick answers
- Is CVE-2026-116781 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116781 being exploited in the wild.
- How severe is CVE-2026-116781?
- Medium severity, with a CVSS score of 5.3, published 5 November 2026.
- Which products and versions are affected?
- SignalWire FreeSWITCH before 1.11.2.
- Is there a fix for CVE-2026-116781?
- Yes: fixed in 1.11.2. Until then: Keep mod_xml_rpc disabled in configuration (the default state), or disable the WebSocket endpoint by not setting enable-websocket in mod_xml_rpc.conf.xml. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116781 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-116781?
- Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 1.11.2
Keep mod_xml_rpc disabled in configuration (the default state), or disable the WebSocket endpoint by not setting enable-websocket in mod_xml_rpc.conf.xml.
Technical details
The ws_read_frame() function in mod_xml_rpc incorrectly unmasked WebSocket payload data by iterating over the full frame size (including headers) rather than the payload-only size, causing up to 14 bytes of out-of-bounds XOR writes using an attacker-supplied mask key. Additionally, a boundary check was off-by-one, allowing a frame filling the 64 KiB buffer to write a terminating NUL one byte past the buffer. The attack is reachable before authentication when mod_xml_rpc is enabled with WebSocket support, though writes remain within the same connection handle's adjacent outbound buffer with no demonstrated process crash or cross-session disclosure.
Affected products
- SignalWire FreeSWITCH before 1.11.2
Timeline
- 2026-11-05: disclosed