CVE-2026-49475: FreeSWITCH: Out-of-bounds memory access in core STUN attribute parsing

Synopsis

Out-of-bounds memory access in FreeSWITCH's core STUN attribute parser allows a remote, unauthenticated attacker to crash the affected service by sending a crafted STUN packet with a deliberately undersized attribute length field. The parser casts the attribute to a larger structure and reads and writes past the end of the per-leg media buffer, triggering memory corruption. Successful exploitation causes a denial of service against the FreeSWITCH process. Note: the CVE description states a fix exists in version 1.11.0, but no fix version has been formally published in the advisory record; HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available as soon as a fix version is confirmed.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The STUN parser is exposed over the network; an attacker must be able to send UDP or TCP STUN packets to the FreeSWITCH media port to trigger the vulnerability.

• AuthenticationNot required

  No credentials or session are required; the malformed STUN packet is processed before any authentication check.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user or administrator of the affected system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or environmental prerequisites beyond network access.

Blast Radius

• The FreeSWITCH process crashes, dropping all active calls and media sessions on the affected node.
• All in-progress call legs handled by the affected instance are terminated immediately, disrupting real-time voice and video traffic.
• Service remains unavailable until the process is restarted, and repeated exploitation can prevent recovery if the attacker continues sending malformed packets.