CVE-2026-49841: FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read

Synopsis

A heap buffer overflow vulnerability exists in the mod_verto HTTP POST body handler of FreeSWITCH prior to version 1.11.1. The flaw is reachable over the network without any authentication, because the overflow occurs before the HTTP basic-auth check runs. Successful exploitation gives an attacker full read, write, and execution control over the affected process, enabling data theft, tampering, or remote code execution. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable HTTP handler is exposed over the network; an attacker must be able to send an HTTP POST request to the FreeSWITCH mod_verto listener.

• AuthenticationNot required

  The heap overflow is triggered before the HTTP basic-auth check executes, so no credentials are needed.

• Victim interactionNot required

  Exploitation is fully server-side; no user action or social engineering is required.

• Attack complexityDetail

  The exploit is reliable and condition-free: the attacker simply supplies a Content-Length value up to just under 10 MiB while the allocated buffer is only 2 MiB, with no race conditions or memory-layout dependencies required.

Blast Radius

• Reads process memory, which may include session tokens, credentials, call-detail records, and other data held in the FreeSWITCH heap.
• Overwrites heap data with attacker-controlled content, allowing modification of internal state, routing tables, or persisted call configuration.
• Achieves remote code execution on the host running FreeSWITCH by corrupting heap metadata or function pointers.
• Crashes the FreeSWITCH process entirely, taking down all active calls and telephony services on the affected node.