CVE-2026-116784 FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing

What is CVE-2026-116784?

CVE-2026-116784 is a high-severity vulnerability in signalwire freeswitch, published on 5 Nov 2026.

Official description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet's declared RTCP header length as its feedback-entry loop bound instead of the datagram length already validated by the caller. A short packet with an oversized declaration could drive reads far beyond the fixed 16 KiB receive buffer. Any peer able to send RTCP to an active video call can reach the flaw, including calls where remote SDP enables video RTCP even though the SIP profile has no explicit RTCP interval configured. The out-of-bounds read can crash FreeSWITCH and terminate every active call, but supplies no write primitive and does not echo the read values to the sender. This issue is fixed in version 1.11.2.

Weakness: CWE-125

Which versions are affected by CVE-2026-116784?

It affects 1 product.

Products include Freeswitch.

How do I fix CVE-2026-116784?

No fix has been published for CVE-2026-116784 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116784 being exploited?

There is no known exploitation of CVE-2026-116784 in the wild and no public exploit code.

Other vulnerabilities in signalwire freeswitch

• CVE-2026-116779 SignalWire FreeSwitch Code Injection Exploited Critical 9.8
• CVE-2026-49841 FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read Critical 9.8
• CVE-2019-19492 FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml. Critical 9.8
• CVE-2026-116785 FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling Critical 9.1
• CVE-2026-116790 FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f3xg-63wg-hjw4.