Out-of-Bounds Read in FreeSWITCH Software Defined Telecom Stack

CVE-2026-116784

What is CVE-2026-116784?

A vulnerability in FreeSWITCH allows a potential out-of-bounds read through the process_rtcp_report() function. Prior to version 1.11.2, this function incorrectly used the declared RTCP header length of an RTPFB NACK packet as the loop boundary for processing feedback entries, rather than the validated datagram length. This issue allows any peer sending RTCP data to an active video call to exploit the flaw, leading to a crash of the FreeSWITCH application, which can terminate all active calls. Importantly, this vulnerability does not provide a write primitive, nor does it return the read values to the sender. The problem was resolved in version 1.11.2, emphasizing the importance of product updates.

References