CVE-2023-40018 FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID
Remote attackers can trigger out-of-bounds writes via malformed ICE candidates, causing memory corruption, crashes, or potential code execution in FreeSWITCH.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-40018?
CVE-2023-40018 is a high-severity memory corruption vulnerability in signalwire freeswitch, published on 15 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.10, FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID. When an SDP is offered with any ICE candidates with an unknown component ID, FreeSWITCH will make an out of bounds write to its arrays. By abusing this vulnerability, an attacker is able to corrupt FreeSWITCH memory leading to an undefined behavior of the system or a crash of it. Version 1.10.10 contains a patch for this issue.
Weakness: CWE-787
Which versions are affected by CVE-2023-40018?
It affects 1 product.
Products include Freeswitch Freeswitch.
How do I fix CVE-2023-40018?
No fix has been published for CVE-2023-40018 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-40018 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-40018 exists.
Other vulnerabilities in signalwire freeswitch
- CVE-2026-49841 FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read
- CVE-2019-19492 Hardcoded credentials in n/a
- CVE-2026-49840 FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing
- CVE-2021-41145 FreeSWITCH susceptible to Denial of Service via SIP flooding
- CVE-2026-45771 Freeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion
Sources
Also known as GHSA-7mwp-86fv-hcg3.