CVE-2026-116784

Versions of FreeSWITCH prior to 1.11.2 are vulnerable to an out-of-bounds read in the process_rtcp_report() function. The root cause is that the software uses an RTPFB NACK packet's declared RTCP header length as a loop bound instead of the previously validated datagram length. An attacker sendin...

CVE-2026-116784 FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, processrtcpreport used an RTPFB NACK packet's declared RTCP header length as its feedback-entry...