CVE-2026-40614: falha de alta gravidade em pjsip pjproject
PJSIP: Heap buffer overflow in Opus codec decoding
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.5epss 0.2%
PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is a buffer overflow when decoding Opus audio frames due to insufficient buffer size validation in the Opus codec decode path. The FEC decode buffers (dec_frame[].buf) were allocated based on a PCM-derived formula: (sample_rate/1000) * 60 * channel_cnt * 2. At 8 kHz mono this yields only 960 bytes, but codec_parse() can output encoded frames up to MAX_ENCODED_PACKET_SIZE (1280) bytes via opus_repacketizer_out_range(). The three pj_memcpy() calls in codec_decode() copied input->size bytes without bounds checking, causing a heap buffer overflow.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
pjsip · pjprojectCVEs relacionadas — pjsip pjproject
No mesmo produto, das mais perigosas para as menos.
CVE-2021-37706HIGHPotential integer underflow upon receiving STUN message in PJSIPEPSS 4.9%CVE-2022-21723CRITICALOut-of-bounds read in multipart parsing in PJSIPEPSS 4.4%CVE-2022-23608HIGHUse after free in PJSIPEPSS 4.0%CVE-2021-43845HIGHPrevent out-of-bounds read in PJSIPEPSS 3.9%CVE-2022-24764HIGHStack buffer overflow in pjprojectEPSS 2.4%CVE-2022-21722CRITICALPotential out-of-bound read during RTP/RTCP parsing in PJSIPEPSS 2.3%