PatchSiren cyber security CVE debrief

CVE-2026-110658 freeswitch CVE debrief

A heap out-of-bounds read vulnerability exists in Sofia-SIP through version 1.13.18 in the msg_multipart_parse() function. This allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries in an INVITE request with a multipart Content-Type. The vulnerability can cause a denial of service, and defenders of FreeSWITCH Sofia-SIP deployments should assess exposure and verify system versions to prioritize patching or workarounds. The vulnerability affects the Sofia-SIP library, which is used in various products, and its exploitation requires minimal privileges.

Vendor: freeswitch
Product: sofia-sip
CVSS: MEDIUM 6.9
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-14
Original CVE updated: 2026-10-14
Advisory published: 2026-10-14
Advisory updated: 2026-10-14

Who should care

Defenders of FreeSWITCH Sofia-SIP deployments should assess exposure and verify system versions to prioritize patching or workarounds. This includes operators of systems that use Sofia-SIP, as well as security teams and vulnerability management teams. The vulnerability affects various products and systems, and its exploitation can cause a denial of service. Therefore, defenders should review their system configurations and prioritize patching or workarrows

Why it matters

This vulnerability allows unauthenticated remote attackers to crash the Sofia-SIP process, potentially leading to denial of service. Defenders of FreeSWITCH Sofia-SIP deployments should assess exposure and verify system versions to prioritize patching or workarounds.

Potential denial of service through process crashes
Requires verification of Sofia-SIP version and system configurations
May require upgrading to a patched version for protection

Technical summary

The msg_multipart_parse function in Sofia-SIP through 1.13.18 does not properly handle oversized MIME boundaries, allowing remote attackers to cause a denial of service by crashing the process. The vulnerability is caused by a lack of proper input validation, which allows attackers to send malicious requests that can cause the process to crash. The technical details of the vulnerability have been verified through various sources, and its exploitation requires minimal privileges. However, the exact technical impact of the vulnerability is still being investigated, and defenders should verify their system configurations to determine potential exposure.

Defensive priority

Medium priority for defenders of FreeSWITCH Sofia-SIP deployments to assess exposure and verify system versions.

Recommended defensive actions

Assess exposure by verifying Sofia-SIP version
Verify system configurations for potential workarounds
Monitor for potential exploit attempts
Consider upgrading to a patched version if available
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program record and NVD detail page provide official information on the vulnerability. Supplemental sources include a technical description and exploit information from various researchers. The vulnerability has been reported by multiple sources, and its details have been verified through various channels. However, the exact scope of affected products and systems is still being investigated, and defenders should verify their system configurations to determine potential exposure.

Sources and references

Verified primary and authoritative sources

CVE-2026-110658 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-110658

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-110658 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110658

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110658.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://hackmd.io/@haind-pwn/sofia-sip-multipart-oob-read

Supplemental source - technical-description, exploit
Source reference
Unverified legacy reference

URL: https://github.com/freeswitch/sofia-sip/blob/ad36ac8f755308e8b87f98a505e83d4e408e5cc3/libsofia-sip-ua/msg/msg_mime.c

Supplemental source - technical-description
Source reference
Unverified legacy reference

URL: https://github.com/freeswitch/sofia-sip

Supplemental source - product
Source reference
Unverified legacy reference

URL: https://www.vulncheck.com/advisories/sofia-sip-through-1.13.18-heap-out-of-bounds-read-via-msg-multipart-parse

Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.