ALPINE-CVE-2026-40614

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is a buffer overflow when decoding Opus audio frames due to insufficient buffer size validation in the Opus codec decode path. The FEC decode buffers (decframe[].buf) were allocated based on a PCM-derived formula: (samplerate/1000) * 60 * channelcnt * 2. At 8 kHz mono this yields only 960 bytes, but codecparse() can output encoded frames up to MAXENCODEDPACKETSIZE (1280) bytes via opusrepacketizeroutrange(). The three pjmemcpy() calls in codecdecode() copied input->size bytes without bounds checking, causing a heap buffer overflow.