Out-of-bounds read in freeswitch - CVE-2026-116784
Published: November 9, 2026
Vulnerability identifier: #VU162786
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116784
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to crash FreeSWITCH and terminate every call handled by the instance.
The vulnerability exists due to the RTCP NACK parser trusting a packet's declared length instead of its received size, causing an out-of-bounds read when a short packet declares an oversized length. An unauthenticated remote attacker can trigger the crash by delivering a crafted UDP datagram to the negotiated video RTCP port during an active video call with RTCP enabled.
Affected software
freeswitch
How to mitigate CVE-2026-116784
Install security update from vendor's website.
freeswitch - update to 1.11.2