# CVE-2026-116781: FreeSWITCH WebSocket frame parser out-of-bounds write

Source: https://junglewise.ai/threats/cve-2026-116781-freeswitch-is-a-software-defined-telecom-stack-enabling-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-116781 · Severity: medium · CVSS 5.3 · Published 2026-11-05

FreeSWITCH is a software telecommunications platform that powers voice and video communication systems. A flaw in the WebSocket frame parsing code allows an attacker to write data beyond the allocated buffer, potentially corrupting memory. This vulnerability only affects systems with mod_xml_rpc enabled and its WebSocket endpoint activated, which are both disabled by default.

Technologies: [SignalWire FreeSWITCH](https://junglewise.ai/threats/technologies/freeswitch). Vendors: [SignalWire](https://junglewise.ai/threats/vendors/signalwire).

## Quick answers

**Is CVE-2026-116781 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116781 being exploited in the wild.

**How severe is CVE-2026-116781?** Medium severity, with a CVSS score of 5.3, published 5 November 2026.

**Which products and versions are affected?** SignalWire FreeSWITCH before 1.11.2.

**Is there a fix for CVE-2026-116781?** Yes: fixed in 1.11.2. Until then: Keep mod_xml_rpc disabled in configuration (the default state), or disable the WebSocket endpoint by not setting enable-websocket in mod_xml_rpc.conf.xml. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116781 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-116781?** Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.11.2

Keep mod_xml_rpc disabled in configuration (the default state), or disable the WebSocket endpoint by not setting enable-websocket in mod_xml_rpc.conf.xml.

## Technical details

The ws_read_frame() function in mod_xml_rpc incorrectly unmasked WebSocket payload data by iterating over the full frame size (including headers) rather than the payload-only size, causing up to 14 bytes of out-of-bounds XOR writes using an attacker-supplied mask key. Additionally, a boundary check was off-by-one, allowing a frame filling the 64 KiB buffer to write a terminating NUL one byte past the buffer. The attack is reachable before authentication when mod_xml_rpc is enabled with WebSocket support, though writes remain within the same connection handle's adjacent outbound buffer with no demonstrated process crash or cross-session disclosure.

## Affected products

- SignalWire FreeSWITCH before 1.11.2

## Timeline

- 2026-11-05: disclosed

## References

- [https://github.com/signalwire/freeswitch/commit/fb9f37b9c7869630ee52a3ae87399fbbf99ad74d](https://github.com/signalwire/freeswitch/commit/fb9f37b9c7869630ee52a3ae87399fbbf99ad74d)
- [https://github.com/signalwire/freeswitch/releases/tag/v1.11.2](https://github.com/signalwire/freeswitch/releases/tag/v1.11.2)

## Related threats

- [FreeSWITCH ICE integrity validation bypass](https://junglewise.ai/threats/cve-2026-116790-freeswitch-is-a-software-defined-telecom-stack-enabling-the)
- [FreeSWITCH DTLS fingerprint validation bypass in server role](https://junglewise.ai/threats/cve-2026-116789-freeswitch-is-a-software-defined-telecom-stack-enabling-the)
- [FreeSWITCH integer underflow in XML decode](https://junglewise.ai/threats/cve-2026-116788-freeswitch-is-an-open-source-software-telecommunications)
- [FreeSWITCH mod_event_socket denial of service via Content-Length](https://junglewise.ai/threats/cve-2026-116787-freeswitch-is-a-software-defined-telecom-stack-enabling-the)
- [FreeSWITCH command injection via SIP REFER URI parameters](https://junglewise.ai/threats/cve-2026-116786-freeswitch-is-a-software-defined-telecom-stack-enabling-the)