# CVE-2026-116784: FreeSWITCH out-of-bounds read in RTCP NACK handler

Source: https://junglewise.ai/threats/cve-2026-116784-freeswitch-is-a-software-defined-telecom-stack-enabling-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-116784 · Severity: high · CVSS 7.5 · Published 2026-11-05

FreeSWITCH is a software telecom platform that enables telephony calls and video streams over IP networks. A flaw in its RTCP (Real-time Transport Control Protocol) packet handler allows an attacker on an active video call to crash the system by sending a malformed packet, terminating all active calls and causing service disruption. No data theft occurs, but the denial-of-service impact affects all users on the system.

Technologies: [SignalWire FreeSWITCH](https://junglewise.ai/threats/technologies/freeswitch). Vendors: [SignalWire](https://junglewise.ai/threats/vendors/signalwire).

## Quick answers

**Is CVE-2026-116784 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116784 being exploited in the wild.

**How severe is CVE-2026-116784?** High severity, with a CVSS score of 7.5, published 5 November 2026.

**Which products and versions are affected?** SignalWire FreeSWITCH before 1.11.2.

**Is there a fix for CVE-2026-116784?** Yes: fixed in 1.11.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116784 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-116784?** Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.11.2

## Technical details

The process_rtcp_report() function incorrectly used the RTCP header's declared length field as the loop bound for processing NACK feedback entries, rather than validating it against the actual received datagram length. An attacker sending a crafted RTCP NACK packet with an oversized length declaration triggers out-of-bounds reads past the fixed 16 KiB receive buffer. Any peer able to send RTCP traffic to an active video call—including scenarios where remote SDP enables video RTCP without explicit SIP profile configuration—can exploit this. The vulnerability crashes the process without information disclosure or code execution.

## Affected products

- SignalWire FreeSWITCH before 1.11.2

## Timeline

- 2026-11-05: disclosed
- 2026-08-09: patched: version 1.11.2 released

## References

- [https://github.com/signalwire/freeswitch/commit/e730a4e541b2cb49d54018a15f775728e19ce17f](https://github.com/signalwire/freeswitch/commit/e730a4e541b2cb49d54018a15f775728e19ce17f)
- [https://github.com/signalwire/freeswitch/releases/tag/v1.11.2](https://github.com/signalwire/freeswitch/releases/tag/v1.11.2)

## Related threats

- [FreeSWITCH ICE integrity validation bypass](https://junglewise.ai/threats/cve-2026-116790-freeswitch-is-a-software-defined-telecom-stack-enabling-the)
- [FreeSWITCH DTLS fingerprint validation bypass in server role](https://junglewise.ai/threats/cve-2026-116789-freeswitch-is-a-software-defined-telecom-stack-enabling-the)
- [FreeSWITCH integer underflow in XML decode](https://junglewise.ai/threats/cve-2026-116788-freeswitch-is-an-open-source-software-telecommunications)
- [FreeSWITCH mod_event_socket denial of service via Content-Length](https://junglewise.ai/threats/cve-2026-116787-freeswitch-is-a-software-defined-telecom-stack-enabling-the)
- [FreeSWITCH command injection via SIP REFER URI parameters](https://junglewise.ai/threats/cve-2026-116786-freeswitch-is-a-software-defined-telecom-stack-enabling-the)