CVE-2026-40614: PJSIP: Heap buffer overflow in Opus codec decoding
PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is a buffer overflow when decoding Opus audio frames due to insufficient buffer size validation in the Opus codec decode path. The FEC decode buffers (decframe[].buf) were allocated based on a PCM-derived formula: (samplerate/1000) 60 channelcnt 2. At 8 kHz mono this yields only 960 bytes, but codecparse() can output encoded frames up to MAXENCODEDPACKETSIZE (1280) bytes via opusrepacketizeroutrange(). The three pjmemcpy() calls in codecdecode() copied input->size bytes without bounds checking, causing a heap buffer overflow.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40614?
CVE-2026-40614 has a high severity due to the potential for a heap buffer overflow that can lead to arbitrary code execution.
How do I fix CVE-2026-40614?
To fix CVE-2026-40614, upgrade PJSIP to version 2.17 or later where the vulnerability is addressed.
What is the impact of CVE-2026-40614 on affected systems?
The impact of CVE-2026-40614 on affected systems includes the risk of crashes, data corruption, or remote code execution.
Which versions of PJSIP are affected by CVE-2026-40614?
PJSIP versions 2.16 and earlier are affected by CVE-2026-40614.
Is the Opus codec the only component affected by CVE-2026-40614?
Yes, the vulnerability in CVE-2026-40614 specifically affects the Opus codec decoding process within the PJSIP library.