CVE-2026-116784

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.2

Description The process rtcp report() function uses the declared RTCP header length of an RTPFB NACK packet as its feedback-entry loop bound instead of the validated datagram length. A short packet with an oversized declaration can cause an out-of-bounds read beyond the 16 KiB receive buffer. This can be triggered by any peer capable of sending RTCP to an active video call, including those where remote SDP enables video RTCP without an explicit SIP profile RTCP interval. This flaw can lead to a system crash and the termination of all active calls.

Recommendations Update to version 1.11.2.