Executive brief
FreeSWITCH is an open-source telephony platform used to route and manage voice and video calls. A vulnerability in how the system handles certain network packets (STUN) allows a remote attacker to crash the entire service by sending a single specially crafted message. This results in a total service outage, dropping all active calls and preventing new connections until the system is restarted.
Technical details
An out-of-bounds read and write vulnerability exists in the `switch_stun_packet_parse()` function of FreeSWITCH. The parser fails to verify that a STUN attribute's declared length is sufficient to contain the data structures it subsequently casts to (such as `switch_stun_ip_t` or `uint32_t`). When the parser performs byteswap operations (ntohs/htonl) on these undersized attributes, it accesses memory beyond the intended buffer. This occurs before HMAC integrity checks, meaning an unauthenticated attacker can trigger a process crash by sending a crafted UDP packet to a media port on any ICE-enabled call leg. The issue is fixed in version 1.11.0 by adding explicit size checks before type-specific casting.
Affected products
- SignalWire FreeSWITCH <= 1.10.12
Timeline
- 2026-06-03: advisory: GitHub Security Advisory published
- 2026-06-09: disclosed: CVE published to NVD
- 2023-05-07: patched: Version 1.11.0 released with fix