CVE-2026-116780

FreeSWITCH versions prior to 1.11.2 are vulnerable to a heap out-of-bounds read in the core variable expansion mechanism. The flaw exists in the switch_event_expand_headers_check() function, where a positive offset in ${variable:offset} slicing that exceeds the variable's length causes the system...