CVE-2026-116784

Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.

Copy to clipboard

  <vuln vid="FIXME (make newentry)">
    <topic>freeswitch -- FIXME</topic>
    <affects>
      <package>
	<name>freeswitch</name>
	<range><lt>1.11.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-116784: FreeSWITCH is a Software Defined Telecom Stack
	  enabling the digital transformation from proprietary telecom
	  switches to a software implementation that runs on any commodity
	  hardware. Prior to 1.11.2, process_rtcp_report() used an RTPFB NACK
	  packet's declared RTCP header length as its feedback-entry loop
	  bound instead of the datagram length already validated by the
	  caller. A short packet with an oversized declaration could drive
	  reads far beyond the fixed 16 KiB receive buffer. Any peer able to
	  send RTCP to an active video call can reach the flaw, including
	  calls where remote SDP enables video RTCP even though the SIP
	  profile has no explicit RTCP interval configured. The out-of-bounds
	  read can crash FreeSWITCH and terminate every active call, but
	  supplies no write primitive and does not echo the read values to
	  the sender. This issue is fixed in version 1.11.2.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-116784</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-116784</url>
    </references>
    <dates>
      <discovery>2026-11-05</discovery>
      <entry>2026-11-05</entry>
    </dates>
  </vuln>