{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-116784 in the wild and no public exploit code.","exposure":"","fix":"No fix has been published for CVE-2026-116784 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-116784 is a high-severity vulnerability in signalwire freeswitch, published on 5 Nov 2026."},"fix_prompt":"Check this codebase for CVE-2026-116784 and fix it if it is affected.\n\nWhat it is: CVE-2026-116784 is a high-severity vulnerability in signalwire freeswitch, published on 5 Nov 2026. \nExploitation: There is no known exploitation of CVE-2026-116784 in the wild and no public exploit code.\n\nAffected product: signalwire freeswitch. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-116784/ (Markdown: https://insights.sbomify.com/CVE-2026-116784/index.md)","id":"CVE-2026-116784","markdown":"https://insights.sbomify.com/CVE-2026-116784/index.md","name":"CVE-2026-116784","record":{"aliases":["GHSA-f3xg-63wg-hjw4"],"analysis":null,"analysis_generated_by":null,"assigner":"GitHub_M","cpe":[{"name":"Freeswitch","product":"freeswitch","vendor":"freeswitch"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-125","name":"Out-of-bounds Read"}],"description":"FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet's declared RTCP header length as its feedback-entry loop bound instead of the datagram length already validated by the caller. A short packet with an oversized declaration could drive reads far beyond the fixed 16 KiB receive buffer. Any peer able to send RTCP to an active video call can reach the flaw, including calls where remote SDP enables video RTCP even though the SIP profile has no explicit RTCP interval configured. The out-of-bounds read can crash FreeSWITCH and terminate every active call, but supplies no write primitive and does not echo the read values to the sender. This issue is fixed in version 1.11.2.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing","id":"CVE-2026-116784","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling","id":"CVE-2026-116785"},"nickname":null,"packages":[],"prev":{"headline":"FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery data","id":"CVE-2026-116783"},"products":["freeswitch"],"published":"2026-11-05","related":[{"cvss_score":9.8,"headline":"SignalWire FreeSwitch Code Injection","id":"CVE-2026-116779","kev_date_added":"2026-11-09","published":"2026-11-05"},{"cvss_score":9.8,"headline":"FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read","id":"CVE-2026-49841","kev_date_added":null,"published":"2026-06-09"},{"cvss_score":9.8,"headline":"FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.","id":"CVE-2019-19492","kev_date_added":null,"published":"2019-12-02"},{"cvss_score":9.1,"headline":"FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling","id":"CVE-2026-116785","kev_date_added":null,"published":"2026-11-05"},{"cvss_score":9.1,"headline":"FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY","id":"CVE-2026-116790","kev_date_added":null,"published":"2026-11-05"},{"cvss_score":9.1,"headline":"FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing","id":"CVE-2026-49840","kev_date_added":null,"published":"2026-06-09"},{"cvss_score":8.8,"headline":"FreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod_sofia","id":"CVE-2026-116786","kev_date_added":null,"published":"2026-11-05"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-11-05","vendors":["signalwire"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-116784/"}