Buffer Overflow in PJSIP Audio Codec Affects Multimedia Communication Software

CVE-2026-40614

What is CVE-2026-40614?

The PJSIP library, used for multimedia communication, contains a vulnerability that allows a buffer overflow during the decoding of Opus audio frames. This issue is due to insufficient validation of buffer sizes when processing audio data, specifically in the codec_decode function. The output buffer is allocated based on a formula that does not account for maximum encoded frame sizes, which can lead to copying more data than the allocated buffer can hold. This flaw exposes the system to potential exploitation, allowing adversaries to cause crashes or introduce malicious code.

References