Loading story…
FreeSWITCH released fixes in v1.11.1 for two critical pre-authentication heap buffer overflow vulnerabilities that could crash exposed voice servers and may enable remote code execution. The most severe issue, CVE-2026-49841 (CVSS 9.8), affects the mod_verto HTTP request handler: affected versions before 1.11.1 allocate a fixed 2 MiB buffer for application/x-www-form-urlencoded POST bodies while accepting a Content-Length of nearly 10 MiB, allowing an attacker to overflow the heap by roughly 8 MiB over the network before HTTP basic authentication is checked.
A second flaw, CVE-2026-49840 (CVSS 9.1), affects the libesl library, where esl_recv_event() uses atol() to parse Content-Length and passes the result to malloc() without final validation, creating a path to memory corruption or denial of service through negative values. Although no public exploit was reported, both bugs were described as easy to trigger, prompting guidance to upgrade immediately to FreeSWITCH v1.11.1, restrict Verto and ESL access to trusted networks, remove Verto vhost entries, disable mod_verto if it is not needed, and isolate the control-plane network.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A new CVE entry, CVE-2026-49841, was published describing a network-reachable pre-authentication heap buffer overflow in FreeSWITCH mod_verto. The disclosure assigned a CVSS 9.8 severity and linked the issue to the FreeSWITCH fix in version 1.11.1.
FreeSWITCH patched the pre-authentication heap buffer overflow in the mod_verto HTTP request handler in version 1.11.1. The flaw affects versions prior to 1.11.1 and can overflow a fixed 2 MiB heap buffer via an oversized POST body before authentication.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed in **PJSIP** affecting version `2.16` and earlier, exposing the widely used multimedia communication library to memory corruption risks. `CVE-2026-40614` is a **heap buffer overflow** in the Opus codec decode path, where insufficient validation of buffer sizes allows `codec_decode()` to copy more data than allocated after `codec_parse()` emits encoded frames larger than the FEC decode buffer calculation anticipates. The flaw is tied to unchecked `pj_memcpy()` operations and was classified as `CWE-122`, with high potential impact to confidentiality, integrity, and availability. A second issue, `CVE-2026-40892`, is a **stack buffer overflow** in `pjsip_auth_create_digest2()` when pre-computed digest credentials are supplied through `PJSIP_CRED_DATA_DIGEST`. In that path, credential data is copied using `cred_info->data.slen` without enforcing the expected digest-length limit, allowing overflow of the fixed 128-byte `ha1` stack buffer. The vulnerability was classified as `CWE-121`, and both CVEs were published with GitHub advisory references and fixing commits, indicating that maintainers have issued patches for affected deployments.
Jun 29, 2026
OpenSIPS disclosed **CVE-2026-45100**, a critical remotely exploitable buffer overflow in the `{s.b64encode}` string transformation affecting versions **3.4.0-beta through 3.6.5** and **4.0.0-beta**. The flaw stems from validating only the pre-encoding input against a 64 KB buffer, even though Base64 expansion can increase output size enough to overflow the buffer by up to **21,844 bytes**. An attacker can trigger the issue by sending a SIP message with a very large header value when an OpenSIPS routing script applies `{s.b64encode}` to attacker-controlled data. The overflow can corrupt adjacent transformation buffers and alter values used by later transformations processing the same SIP message, creating integrity and availability risk. OpenSIPS addressed the issue through code changes that enforce stricter bounds checks on input-derived lengths and related parsing logic across the codebase, including Base64 encoding and other buffer-sensitive components. The vendor fixed the vulnerability in **OpenSIPS 3.6.6** and **4.0.0-rc1**; the flaw is tracked as **CWE-120** and carries a **CVSS 9.1** rating.
Aug 5, 2026
FreePBX, the open-source IP PBX platform, has patched several critical vulnerabilities in its Endpoint Manager module that could allow attackers to bypass authentication and achieve remote code execution. Researchers from Horizon3.ai identified three high-severity flaws: CVE-2025-66039 (authentication bypass via forged Basic Auth headers when 'webserver' authorization is enabled), CVE-2025-61675 (multiple SQL injection vulnerabilities across several endpoints), and CVE-2025-61678 (arbitrary file upload enabling PHP webshell deployment). These vulnerabilities, when chained, allow unauthenticated attackers to gain full control over affected FreePBX instances, posing a significant risk to business communications infrastructure. The authentication bypass is not present in the default configuration but becomes exploitable if certain advanced settings are enabled. Attackers can exploit these flaws to access protected endpoints, manipulate the underlying SQL database, and upload malicious files for command execution. The vulnerabilities were responsibly disclosed to FreePBX maintainers, and patches have been released. Organizations using FreePBX, especially those with non-default authentication settings, are urged to update immediately to mitigate the risk of compromise.
Jun 29, 2026