CVE-2026-116779

SignalWire FreeSwitch Code Injection Vulnerability

Freeswitch

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAGE on a plus sign and treated the left side as a chat protocol selector. Selecting the api chat proto reached switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API…

5. Nov 2026

Ausgewertete Quellen

• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-116779
• CISA
  SignalWire FreeSwitch Code Injection Vulnerability
• NVD
  CVE-2026-116779
• GitHub
  https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p