CVE-2026-71980

Name of the Vulnerable Software and Affected Versions bcg729 versions prior to 1.1.3

Description An out-of-bounds read exists in the decodeSIDframe() function within src/cng.c. Unauthenticated network-adjacent attackers can trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. This occurs because a zero-length payload causes an integer underflow in the uint8 t filter order calculation, which wraps to 255 and is clamped to 10. Consequently, the function reads 11 bytes from a zero-byte buffer, leading to media process termination or the silent consumption of adjacent heap memory as reflection coefficients.

Recommendations Update to a version newer than 1.1.2. As a temporary workaround, restrict the use of the decodeSIDframe() function to minimize the risk of exploitation.