SignalWire FreeSWITCH up to 1.11.1 RTCP Report Processing process_rtcp_report out-of-bounds

Summaryinfo

A vulnerability was found in SignalWire FreeSWITCH up to 1.11.1. It has been rated as critical. Affected by this issue is the function process_rtcp_report of the component RTCP Report Processing. This manipulation causes out-of-bounds. This vulnerability is handled as CVE-2026-116784. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in SignalWire FreeSWITCH up to 1.11.1. Affected by this vulnerability is the function process_rtcp_report of the component RTCP Report Processing. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. The summary by CVE is:

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet's declared RTCP header length as its feedback-entry loop bound instead of the datagram length already validated by the caller. A short packet with an oversized declaration could drive reads far beyond the fixed 16 KiB receive buffer. Any peer able to send RTCP to an active video call can reach the flaw, including calls where remote SDP enables video RTCP even though the SIP profile has no explicit RTCP interval configured. The out-of-bounds read can crash FreeSWITCH and terminate every active call, but supplies no write primitive and does not echo the read values to the sender. This issue is fixed in version 1.11.2.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-116784 since 10/26/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.

Upgrading to version 1.11.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• SignalWire

Name

• FreeSWITCH

Version

• 1.11.0
• 1.11.1

Website

• Product: https://github.com/signalwire/freeswitch/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion