Is CVE-2026-116784 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116784 being exploited in the wild.

How severe is CVE-2026-116784?

High severity, with a CVSS score of 7.5, published 5 November 2026.

Which products and versions are affected?

SignalWire FreeSWITCH before 1.11.2.

Is there a fix for CVE-2026-116784?

Yes: fixed in 1.11.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116784 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-116784?

Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116784: FreeSWITCH out-of-bounds read in RTCP NACK handler

CVE-2026-116784 · Severity: high · CVSS 7.5 · Published 2026-11-05

FreeSWITCH is a software telecom platform that enables telephony calls and video streams over IP networks. A flaw in its RTCP (Real-time Transport Control Protocol) packet handler allows an attacker on an active video call to crash the system by sending a malformed packet, terminating all active calls and causing service disruption. No data theft occurs, but the denial-of-service impact affects all users on the system.

Technologies: SignalWire FreeSWITCH. Vendors: SignalWire.

Quick answers

Is CVE-2026-116784 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116784 being exploited in the wild.
How severe is CVE-2026-116784?: High severity, with a CVSS score of 7.5, published 5 November 2026.
Which products and versions are affected?: SignalWire FreeSWITCH before 1.11.2.
Is there a fix for CVE-2026-116784?: Yes: fixed in 1.11.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116784 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-116784?: Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.11.2

Technical details

The process_rtcp_report() function incorrectly used the RTCP header's declared length field as the loop bound for processing NACK feedback entries, rather than validating it against the actual received datagram length. An attacker sending a crafted RTCP NACK packet with an oversized length declaration triggers out-of-bounds reads past the fixed 16 KiB receive buffer. Any peer able to send RTCP traffic to an active video call—including scenarios where remote SDP enables video RTCP without explicit SIP profile configuration—can exploit this. The vulnerability crashes the process without information disclosure or code execution.

Affected products

SignalWire FreeSWITCH before 1.11.2

Timeline

2026-11-05: disclosed
2026-08-09: patched: version 1.11.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.