Vendor
Signalwire
45 known vulnerabilities in products by Signalwire, 1 of them actively exploited (CISA KEV).
Key figures
45
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
7
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-116779 | FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands In CISA KEValso in 1 other product | 9.8 | |
| Critical | CVE-2022-31003 | Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP | 9.1 | |
| Critical | CVE-2023-22741 | heap-over-flow in stun_parse_attribute in sofia-sip | 9.8 | |
| Critical | CVE-2026-116785 | Signalwire Freeswitch: Heap-based Buffer Overflow | 9.1 | |
| High | CVE-2021-37624 | FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofing | 7.5 | |
| High | CVE-2021-41105 | FreeSWITCH susceptible to Denial of Service via invalid SRTP packets | 7.5 | |
| High | CVE-2022-31001 | Out-of-bounds Read in Sofia-SIP | 7.5 | |
| High | CVE-2026-116783 | FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery data | 8.2 | |
| High | CVE-2026-115928 | FreeSWITCH: Stack buffer overflow parsing the SDP a=crypto key material on inbound calls | 7.5 | |
| High | CVE-2021-41145 | FreeSWITCH susceptible to Denial of Service via SIP flooding | 8.6 | |
| High | CVE-2022-31002 | Out-of-bounds Read in Sofia-SIP | 7.5 | |
| High | CVE-2021-36513 | Signalwire Freeswitch: Use of Uninitialized Memory | 7.5 | |
| High | CVE-2026-116569 | FreeSWITCH: Pre-authentication out-of-bounds write in MSRP message body parsing | 7.5 | |
| High | CVE-2026-116786 | FreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod_sofia | 8.8 | |
| High | CVE-2023-51443 | FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation | 7.5 | |
| High | CVE-2026-116570 | FreeSWITCH: Pre-authentication stack buffer overflow in mod_xml_rpc HTTP directory authentication | 7.5 | |
| High | CVE-2026-116782 | FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling | 7.5 | |
| High | CVE-2026-116568 | FreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsing | 7.5 | |
| Critical | CVE-2026-116790 | FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY | 9.1 | |
| High | CVE-2026-116787 | Signalwire Freeswitch: Memory Allocation with Excessive Size Value | 7.5 | |
| High | CVE-2026-116788 | FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding | 8.2 | |
| High | CVE-2026-116784 | FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing | 7.5 | |
| High | CVE-2026-116567 | FreeSWITCH: Pre-authentication stack buffer overflow in mod_rtmp control-message handling | 7.5 | |
| High | CVE-2026-49846 | libks has path traversal in kws HTTP parser via URI segment overflow | 7.5 | |
| Critical | CVE-2026-49841 | FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read | 9.8 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 24sans-atrisk-mail,
Products
| Freeswitch | 39 | 0 |
| Sofia-sip | 5 | 0 |