CVE-2026-40614

Name of the Vulnerable Software and Affected Versions PJSIP versions prior to 2.17

Description A heap buffer overflow occurs when decoding Opus audio frames due to insufficient buffer size validation in the Opus codec decode path. The FEC decode buffers dec frame[].buf are allocated using a PCM-derived formula that can result in a size of 960 bytes for 8 kHz mono audio. However, the codec parse() function can output encoded frames up to 1280 bytes via opus repacketizer out range(). Consequently, three pj memcpy() calls within the codec decode() function copy input->size bytes without bounds checking, leading to the overflow.

Recommendations Update to a version later than 2.16.