CVE-2026-116784

Versions of FreeSWITCH prior to 1.11.2 are vulnerable to an out-of-bounds read in the process_rtcp_report() function. The root cause is that the software uses an RTPFB NACK packet's declared RTCP header length as a loop bound instead of the previously validated datagram length. An attacker sendin...