CVE-2026-116784High· 7.5▾ TwilightFreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, process_rtcp_report() used an RTPFB N…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet's declared RTCP header length as its feedback-entry loop bound instead of the datagram length already validated by the caller. A short packet with an oversized declaration could drive reads far beyond the fixed 16 KiB receive buffer. Any peer able to send RTCP to an active video call can reach the flaw, including calls where remote SDP enables video RTCP even though the SIP profile has no explicit RTCP interval configured. The out-of-bounds read can crash FreeSWITCH and terminate every active call, but supplies no write primitive and does not echo the read values to the sender. This issue is fixed in version 1.11.2.
freeswitch < 1.11.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116568High· 7.5FreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsing
CVE-2026-116782High· 7.5FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling
CVE-2026-116780Low· 2.7FreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via `${variable:offset}` slicing
CVE-2026-116787High· 7.5FreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-Length
CVE-2026-116572Medium· 6.5FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP Contact display-name
CVE-2026-116573Medium· 6.5FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP To-header user