Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-110658
freeswitch sofia-sip — Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N L N N N N N L 6.9 .0067 51.2 —
AFFECTED
Product Versions Fixed
sofia-sip unspecified —
TIMELINE
Oct 14 EXPLOIT PUBLISHED — CVE-2026-110658 (freeswitch sofia-sip). Public exploit reference added.
Oct 14 Reserved by VulnCheck
Oct 14 Published (CNA: VulnCheck)
Description
Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length, causing memcmp to read past the heap buffer and crash the process.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| October 14, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-110658 (freeswitch sofia-sip). Public exploit reference added. |
| October 14, 2026 | Reserved | Reserved by VulnCheck |
| October 14, 2026 | Published | Published (CNA: VulnCheck) |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| freeswitch | sofia-sip | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-110658 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
