This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-49840 | BDVDB-2026-339364 Detail

signalwirefreeswitch

Description#

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, esl_recv_event() parses Content-Length with atol() and passes the result straight to malloc(len + 1) with no sign or magnitude check. A malicious or man-in-the-middle ESL peer can send a frame with a negative Content-Length to corrupt the heap of, or crash, any process linked against libesl, before the client has authenticated to that peer. This issue has been patched in version 1.11.1.

Impact#

Per CVSS v3.1: confidentiality impact none, integrity impact high, availability impact high. Attack vector: network.

Weaknesses#

  • CWE-20 Improper Input Validation
  • CWE-122 Heap-based Buffer Overflow
  • CWE-195 Signed to Unsigned Conversion Error
  • CWE-787 Out-of-bounds Write

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.