FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.0, a STUN packet whose declared attribute length is shorter than the structure the parser casts to causes the parser to read and write past the end of the attribute, producing an out-of-bounds memory access on the per-leg media buffer. This issue has been patched in version 1.11.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
References
History
Tue, 09 Jun 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.0, a STUN packet whose declared attribute length is shorter than the structure the parser casts to causes the parser to read and write past the end of the attribute, producing an out-of-bounds memory access on the per-leg media buffer. This issue has been patched in version 1.11.0. | |
| Title | FreeSWITCH: Out-of-bounds memory access in core STUN attribute parsing | |
| Weaknesses | CWE-125 CWE-20 CWE-787 |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-06-09T16:00:32.931Z
Reserved: 2026-05-30T04:17:43.095Z
Link: CVE-2026-49475
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-06-09T17:17:47.390
Modified: 2026-06-09T17:17:47.390
Link: CVE-2026-49475
Redhat
No data.
OpenCVE Enrichment
No data.