CVE-2025-65102

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-65102
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-65102.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-65102
Aliases
  • GHSA-w5vr-39x7-h8g5
Downstream
Published
2025-11-21T21:36:58.375Z
Modified
2026-07-22T00:05:50.977276Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
PJSIP is vulnerable to buffer overflow in Opus PLC
Details

PJSIP is a free and open source multimedia communication library. Prior to version 2.16, Opus PLC may zero-fill the input frame as long as the decoder ptime, while the input frame length, which is based on stream ptime, may be less than that. This issue affects PJSIP users who use the Opus audio codec in receiving direction. The vulnerability can lead to unexpected application termination due to a memory overwrite. This issue has been patched in version 2.16.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65102.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-120"
    ]
}
References

Affected packages

Git / github.com/pjsip/pjproject

Affected ranges

Type
GIT
Repo
https://github.com/pjsip/pjproject
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6e9bd2e7d25bba26f852771b40693f45da14fa8f
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.16"
        }
    ]
}

Affected versions

2.*
2.10
2.11
2.12
2.13
2.14
2.15

Database specific

vanir_signatures 
[
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "266677233653437687354229639551213848494",
                "65103337288911274990102013824264095072",
                "208172665598254958365738996672419436578",
                "16031429547521329963943737443720001478",
                "145573090340297391084704162591241597395",
                "81720341765190602602281032603157208154",
                "255579187264193398118188440222486814249",
                "135007708480694161233127367069617497606"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/pjsip/pjproject/commit/6e9bd2e7d25bba26f852771b40693f45da14fa8f",
        "signature_type": "Line",
        "target": {
            "file": "pjmedia/src/pjmedia-codec/opus.c"
        },
        "id": "CVE-2025-65102-41a388f9",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "122694558069801170264860034441229696318",
                "129664248851347442436969382803161937776",
                "159046775279221147291935734091644058084",
                "149005411813299949332515910750044666457",
                "326684543566527255901340159366239667640",
                "337264212753703434321063300238456276295",
                "145476484519384861993549689529315840763",
                "153739624830494098136309316217373918845",
                "207116757588732938147593473684204256673",
                "156397106107136441385670546955028702098",
                "319740107819148200395124785553104509673",
                "162690846469883172405285835886088180203",
                "272008023884124690660757730539583274499",
                "242300194993340498891905159267008455414",
                "151942415283499532786423084633024329392",
                "277816535385539487655056634619671715147",
                "232550363193913262310996000144101686723",
                "226907591253604149687130649758222311897",
                "258657943316001050738949932151467048738",
                "296231278770832101922998457610149165819",
                "109315122074318703949549751098487858245",
                "163622078261635695470849442778749687812",
                "66708161159865053806317299962033553195",
                "93090182610298779569102157457108926030",
                "260647573654027243403635591420185588481",
                "316262812100567710741656621744195993400",
                "193975255802107508773010058871464869573",
                "6621217610933576917539348749374800338",
                "216616189436116083358306662673779390218",
                "13433493938329903456426822240493926917",
                "167825190159718900155772899276113110274",
                "13522382534627691585181350937158453147",
                "58390482627251585418662440568090968166",
                "164464568104048288652567625868216992350",
                "93122271705184084418664886807789998945",
                "107134357973151475649438088860630541471",
                "299886988703060691584287819039654578323",
                "264795615782846125006352902990869686294",
                "130253418581540125665010099148611240200",
                "89403158925667848531099670990388157234",
                "33413498460271530756753944561772263774",
                "146533755909091879550979207138945575220",
                "50097136764630111581401056630024655365",
                "277816535385539487655056634619671715147",
                "232550363193913262310996000144101686723",
                "25778086189755759715407680212213647927",
                "106878453692657096885352253877196501876",
                "118489295280204605156573422060363356748",
                "141574388173526644706045176374645129116",
                "109315122074318703949549751098487858245",
                "163622078261635695470849442778749687812",
                "302545135485801851496595226463806426666",
                "19349567768002172447282873029257442396",
                "56245617646768187735540368123993955591",
                "129599692267079976120437848810246070908",
                "152759636892921202390294956043858639445",
                "26536131523176688006593826167014096860",
                "103554719717867850641889036187416711869",
                "139057044368259788629483439196453677420",
                "300599983526422109562897609466283387099",
                "4224808553793635992679829771373023837",
                "256514919001375477111753233079188075788",
                "116744148056288543763612278403784747763",
                "131029949637804238960845034486909266210",
                "282120346126332799883714378113514484564",
                "52130217643159043840390761528281639891",
                "118455725186244670893983723524220172246",
                "106921301880379241465632793889295938025",
                "247713562870296098448259681296764837026",
                "101738587881292771384037958173933176374",
                "177881019581279403060315200758343698167",
                "86803932862788322286199425386053004182",
                "277816535385539487655056634619671715147",
                "232550363193913262310996000144101686723",
                "25778086189755759715407680212213647927",
                "106878453692657096885352253877196501876",
                "118489295280204605156573422060363356748",
                "141574388173526644706045176374645129116",
                "109315122074318703949549751098487858245",
                "163622078261635695470849442778749687812",
                "302545135485801851496595226463806426666",
                "19349567768002172447282873029257442396",
                "56245617646768187735540368123993955591",
                "129599692267079976120437848810246070908",
                "152759636892921202390294956043858639445",
                "26536131523176688006593826167014096860",
                "103554719717867850641889036187416711869",
                "139057044368259788629483439196453677420",
                "180760496692460484288002395830827693878",
                "234988713515572392119678285908259606374",
                "116744148056288543763612278403784747763",
                "131029949637804238960845034486909266210",
                "282120346126332799883714378113514484564",
                "52130217643159043840390761528281639891",
                "118455725186244670893983723524220172246",
                "114170595471101114675837643847203773773",
                "147499635420781371363901726710084487993",
                "310411202807638048511965163154935722620",
                "168450826308728891272083756797255575504",
                "25005463461403813655627602462192721976",
                "157494972424056837964883166068470668042",
                "142261766084648114917784546904607621981",
                "219726299304241038965317703991508240840",
                "159070414734074949627600781541517588275",
                "151253520474011043686410061043385296506",
                "304538171568077395955393561534126392485",
                "328357405969887172467810130357428273220"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/pjsip/pjproject/commit/6e9bd2e7d25bba26f852771b40693f45da14fa8f",
        "signature_type": "Line",
        "target": {
            "file": "pjmedia/src/pjmedia/stream.c"
        },
        "id": "CVE-2025-65102-490d4e9a",
        "deprecated": false
    },
    {
        "digest": {
            "length": 1572.0,
            "function_hash": "18095722557973322055090563893942528"
        },
        "signature_version": "v1",
        "source": "https://github.com/pjsip/pjproject/commit/6e9bd2e7d25bba26f852771b40693f45da14fa8f",
        "signature_type": "Function",
        "target": {
            "function": "codec_recover",
            "file": "pjmedia/src/pjmedia-codec/opus.c"
        },
        "id": "CVE-2025-65102-7982119a",
        "deprecated": false
    },
    {
        "digest": {
            "length": 6155.0,
            "function_hash": "157483576804071798368107574385551929692"
        },
        "signature_version": "v1",
        "source": "https://github.com/pjsip/pjproject/commit/6e9bd2e7d25bba26f852771b40693f45da14fa8f",
        "signature_type": "Function",
        "target": {
            "function": "get_frame",
            "file": "pjmedia/src/pjmedia/stream.c"
        },
        "id": "CVE-2025-65102-c0e46a05",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-07-22T00:05:50Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-65102.json"