Medium severity · published Jun 9, 2026
CVE-2026-49472
FreeSWITCH includes a vulnerable function, PREFIX(prologTok)() from libexpat
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.0, FreeSWITCH includes a vulnerable function, PREFIX(prologTok)(), in libs/xmlrpc-c/lib/expat/xmltok/xmltok_impl.c, which was cloned from an outdated and vulnerable version in libexpat/libexpat. The function did not receive the corresponding security patch. This issue has been patched in version 1.11.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
freeswitch · signalwire
< 1.11.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-49472
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-49472
Release Notes
https://github.com/signalwire/freeswitch/releases/tag/v1.11.0
Third Party Advisory
https://github.com/signalwire/freeswitch/security/advisories/GHSA-4jm3-xpcm-mwwq
More from freeswitch
9.8
CVE-2026-49841
FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read
9.1
CVE-2026-49840
FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing
7.5
CVE-2026-49847
FreeSWITCH: Stack overflow in bundled cJSON parser via deeply nested JSON
7.5
CVE-2026-49842
FreeSWITCH: Pre-authentication bandwidth amplification via `mod_verto` speed-test frames
7.5
CVE-2026-49475
FreeSWITCH: Out-of-bounds memory access in core STUN attribute parsing