CVE-2026-49475 Overview
CVE-2026-49475 is an out-of-bounds memory access vulnerability in FreeSWITCH, the open-source Software Defined Telecom Stack maintained by SignalWire. The flaw resides in the Session Traversal Utilities for NAT (STUN) packet parser used by the per-leg media buffer. When the parser processes a STUN attribute whose declared length is shorter than the structure the parser casts it to, it reads and writes past the attribute boundary. A remote, unauthenticated attacker can send a crafted STUN packet over the network to trigger the condition. The issue affects all FreeSWITCH builds prior to version 1.11.0 and is tracked under [CWE-20] Improper Input Validation.
Critical Impact
Remote unauthenticated attackers can trigger out-of-bounds memory access in the FreeSWITCH media stack, leading to denial of service on telephony infrastructure.
Affected Products
- FreeSWITCH versions prior to 1.11.0
- SignalWire FreeSWITCH builds using the STUN parser on media legs
- Any deployment exposing FreeSWITCH media endpoints to untrusted networks
Discovery Timeline
- 2026-06-09 - CVE-2026-49475 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-49475
Vulnerability Analysis
FreeSWITCH processes STUN packets as part of its real-time media negotiation, particularly for Interactive Connectivity Establishment (ICE) and NAT traversal on RTP legs. The parser walks each STUN attribute in the inbound packet and casts the raw bytes to a fixed structure based on the attribute type. The parser trusts the attribute type without verifying that the declared length matches or exceeds the size of the target structure.
When an attacker supplies a STUN attribute whose length field is smaller than sizeof(target_struct), the cast causes the parser to dereference memory beyond the attribute boundary. The read may leak adjacent buffer contents, and the subsequent write corrupts memory inside the per-leg media buffer.
Because STUN packets are accepted on media ports before authentication, the attack surface includes any FreeSWITCH instance reachable from untrusted networks. The CVSS vector indicates availability impact only, consistent with a parser crash or media buffer corruption that terminates the FreeSWITCH process or session.
Root Cause
The root cause is missing length validation before a structure cast. The parser should reject any attribute whose declared length is smaller than the structure size for the given attribute type, but the pre-1.11.0 code path performs the cast unconditionally.
Attack Vector
The attacker sends a single malformed STUN binding or attribute packet to a FreeSWITCH media port. No authentication, user interaction, or prior call setup is required. Repeated packets can be used to keep the service in a degraded or crashed state.
No verified proof-of-concept code is publicly available. Refer to the GitHub Security Advisory GHSA-9j6h-hc95-q926 for technical details from the maintainers.
Detection Methods for CVE-2026-49475
Indicators of Compromise
- Unexpected FreeSWITCH process crashes or restarts coinciding with inbound UDP traffic on RTP and STUN ports
- Malformed STUN packets where the attribute length header is smaller than the attribute type's expected structure size
- Spikes in inbound STUN binding requests from unfamiliar source IP addresses
Detection Strategies
- Inspect FreeSWITCH logs for parser errors, segmentation faults, or abrupt session terminations on media legs
- Deploy network IDS signatures that flag STUN packets with attribute length values below the minimum size for the declared attribute type
- Correlate media port traffic anomalies with call quality degradation or session teardown events
Monitoring Recommendations
- Monitor FreeSWITCH service uptime and restart counts as a baseline availability metric
- Capture packet samples on media ports for forensic review when crash events occur
- Track inbound STUN volume per source IP to identify scanning or flooding behavior
How to Mitigate CVE-2026-49475
Immediate Actions Required
- Upgrade FreeSWITCH to version 1.11.0 or later, which contains the parser fix
- Restrict media and STUN port exposure to trusted networks and known SBC peers using firewall ACLs
- Audit current FreeSWITCH deployments for version inventory and patch status
Patch Information
SignalWire patched the issue in FreeSWITCH 1.11.0. The release adds bounds validation in the STUN attribute parser before any cast to an attribute-specific structure. Download the patched release from the FreeSWITCH GitHub Release v1.11.0 and review the maintainer's GitHub Security Advisory GHSA-9j6h-hc95-q926 for upgrade guidance.
Workarounds
- Place FreeSWITCH behind a Session Border Controller (SBC) that validates and sanitizes STUN traffic
- Block inbound STUN traffic from untrusted source ranges at the network edge until the upgrade is applied
- Rate-limit UDP traffic to FreeSWITCH media ports to reduce the impact of repeated malformed packets
# Example iptables rules restricting STUN/media traffic to known peers
iptables -A INPUT -p udp -m multiport --dports 3478,5060,16384:32768 -s <trusted_sbc_ip> -j ACCEPT
iptables -A INPUT -p udp -m multiport --dports 3478,5060,16384:32768 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
