Read the docs
TI-2026-85620 Aliases CVE-2026-116784

Out-of-bounds read in FreeSWITCH RTCP NACK feedback parsing

Priority LOW 33CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

SignalWire FreeSWITCH before 1.11.2 has an out-of-bounds read in RTCP NACK parsing (CWE-125). process_rtcp_report() trusts the length declared in a packet's RTCP header rather than the validated datagram length, so a short packet with an oversized declaration reads far past the 16 KiB receive buffer. Any peer able to send RTCP to an active video call can trigger it and crash FreeSWITCH, ending all active calls.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet's declared RTCP header length as its feedback-entry loop bound instead of the datagram length already validated by the caller. A short packet with an oversized declaration could drive reads far beyond the fixed 16 KiB receive buffer. Any peer able to send RTCP to an active video call can reach the flaw, including calls where remote SDP enables video RTCP even though the SIP profile has no explicit RTCP interval configured. The out-of-bounds read can crash FreeSWITCH and terminate every active call, but supplies no write primitive and does not echo the read values to the sender. This issue is fixed in version 1.11.2.

Why it matters now

EPSS 0.00446 39th percentileScored 2026-11-07
Fix Fixed freeswitch (signalwire): 1.11.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
signalwirefreeswitchbefore 1.11.21.11.2Patch availableCNA
  • freeswitch Vendorsignalwire Affected before 1.11.2 Fixed in 1.11.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:freeswitch:freeswitch:*:*:*:*:*:*:*:*——freeswitch
  • cpe:2.3:a:freeswitch:freeswitch:*:*:*:*:*:*:*:* Versions — — ·freeswitch

Remediation

Upgrade SignalWire FreeSWITCH to version 1.11.2, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA freeswitch (signalwire) Fixed in 1.11.2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-116784
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat
  4. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2023-08915 heap-over-flow in stun_parse_attribute in sofia-sip CVSS 3.1CRITICAL 9.8
  • TI-2022-13049 Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP CVSS 3.1CRITICAL 9.8
  • TI-2023-28097 FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
  • TI-2023-20909 Resource allocation without limits in signalwire freeswitch CVSS 3.1HIGH 7.5
  • TI-2023-20908 FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID CVSS 3.1HIGH 7.5
  • TI-2023-15601 heap-over-flow and integer-overflow in sofia-sip CVSS 3.1HIGH 7.5
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences