FreeSWITCH CVE-2026-49841

The target must be running FreeSWITCH older than 1.11.1 with mod_verto loaded (the default Verto/WebRTC signaling module), and the mod_verto HTTP listener must be reachable by the attacker over the network. Exploitation requires sending a single POST request with Content-Type application/x-www-form-urlencoded and a Content-Length value larger than 2 MiB (up to ~10 MiB); no credentials are needed because the overflow occurs in the body-read loop before the HTTP basic-auth check. Exploitation is limited where mod_verto is disabled, bound only to localhost/trusted interfaces, or fronted by a proxy that enforces a body-size limit below 2 MiB on Verto endpoints; reliable code execution (versus a crash) additionally depends on the target's heap layout and presence/absence of hardening such as ASLR and heap canaries.

All available signals point to high real-world risk. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical) is internally consistent with the description: network-reachable, low complexity, no privileges, no user interaction, and full CIA impact, since a controlled ~8 MiB heap overwrite of adjacent heap structures plausibly leads to RCE or at minimum reliable DoS of the telecom switch. EPSS and CISA KEV data were not supplied in the input, and no public exploit identified at time of analysis, so probability-of-exploitation telemetry is unknown - however, the vendor itself labels v1.11.1 as 'an important release containing critical security fixes' and 'strongly encourages all users to upgrade,' which is an unusually direct vendor signal. The pre-auth nature and the typical exposure of mod_verto on internet-facing WebRTC gateways make this a priority patch rather than a paper-tiger high CVSS.

An attacker reachable over the network sends a single HTTP POST request to the mod_verto HTTP endpoint with Content-Type application/x-www-form-urlencoded and a Content-Length header just under 10 MiB, followed by ~8 MiB of attacker-chosen bytes. mod_verto allocates only a 2 MiB heap buffer but copies the full body into it before the basic-auth check, corrupting adjacent heap metadata and adjacent allocations for potential remote code execution as the FreeSWITCH process, or at minimum crashing the telecom switch. No authentication or user interaction is required.