Out-of-bounds write in pjsip - #VU159421
Published: November 5, 2026
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by crashing an application receiving Opus audio.
The vulnerability exists due to an out-of-bounds write in codec_recover() in pjmedia/src/pjmedia-codec/opus.c when packet loss concealment zero-fills a frame using its unclamped size rather than the caller's buffer size. A remote attacker can send packets that determine the decoder's frame duration to trigger a concealment frame larger than the stream buffer, causing an assertion failure or a heap overflow with zero bytes and crashing the application.
Affected applications must use Opus in the receiving direction with packet loss concealment enabled, which is the default. The zero-fill path is used when there is no previous packet to conceal from.