CVE-2026-40614

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40614
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40614.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40614
Aliases
  • GHSA-j59p-4xrr-fp8g
Downstream
Published
2026-04-21T18:04:15.159Z
Modified
2026-07-15T17:59:39.610796Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
PJSIP: Heap buffer overflow in Opus codec decoding
Details

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is a buffer overflow when decoding Opus audio frames due to insufficient buffer size validation in the Opus codec decode path. The FEC decode buffers (decframe[].buf) were allocated based on a PCM-derived formula: (samplerate/1000) * 60 * channelcnt * 2. At 8 kHz mono this yields only 960 bytes, but codecparse() can output encoded frames up to MAXENCODEDPACKETSIZE (1280) bytes via opusrepacketizeroutrange(). The three pjmemcpy() calls in codecdecode() copied input->size bytes without bounds checking, causing a heap buffer overflow.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-122"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40614.json"
}
References

Affected packages

Git / github.com/pjsip/pjproject

Affected ranges

Type
GIT
Repo
https://github.com/pjsip/pjproject
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5a457451fa2712ba18e12b01738e8ff3af2b26fd
Fixed
17897e835818f8ee03b1806ddcd7b95ea16d2c0e
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:pjsip:pjsip:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.17"
        }
    ]
}

Affected versions

2.*
2.10
2.11
2.12
2.13
2.14
2.15
2.16

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40614.json"
vanir_signatures 
[
    {
        "id": "CVE-2026-40614-3d80afd2",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/pjsip/pjproject/commit/17897e835818f8ee03b1806ddcd7b95ea16d2c0e",
        "deprecated": false,
        "digest": {
            "function_hash": "307741843741102785600521679301194435983",
            "length": 2310.0
        },
        "target": {
            "function": "codec_decode",
            "file": "pjmedia/src/pjmedia-codec/opus.c"
        }
    },
    {
        "id": "CVE-2026-40614-50d81e9c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/pjsip/pjproject/commit/17897e835818f8ee03b1806ddcd7b95ea16d2c0e",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "40998352099753816369358150745877894729",
                "283997858936136985669841392004727120715",
                "138008198829269541789303943184221627525",
                "112071054494798034324092834764551636352",
                "314423035999086905306463896604038598321",
                "339130684049869654880559086658401614261",
                "136095992923886050172605195700247268605",
                "258049715415761607482594563879393146990",
                "179590715693958510418564809653781739286",
                "29557106455553329204775999465476951520",
                "262984748372042230757947587232676985996",
                "180541227855696285522637829008824965527",
                "161118618033905732568007519495921185160",
                "168180776976329238916313184246250555872",
                "158049875721016892320983271044545896346",
                "45951835357598552472368107482868758666",
                "254279629432487127295993042963845794608",
                "87576862660118749219792503296618322409",
                "268650039904163926091801771035637190969",
                "208172665598254958365738996672419436578",
                "64299534233488034448655406118762218409",
                "264198096107991550228002397187107612126"
            ]
        },
        "target": {
            "file": "pjmedia/src/pjmedia-codec/opus.c"
        }
    },
    {
        "id": "CVE-2026-40614-99109a55",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/pjsip/pjproject/commit/17897e835818f8ee03b1806ddcd7b95ea16d2c0e",
        "deprecated": false,
        "digest": {
            "function_hash": "204094393636204851845577606587888003896",
            "length": 1015.0
        },
        "target": {
            "function": "factory_default_attr",
            "file": "pjmedia/src/pjmedia-codec/opus.c"
        }
    },
    {
        "id": "CVE-2026-40614-9f3ba7f9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/pjsip/pjproject/commit/17897e835818f8ee03b1806ddcd7b95ea16d2c0e",
        "deprecated": false,
        "digest": {
            "function_hash": "9054551508075790854765153238424893437",
            "length": 5130.0
        },
        "target": {
            "function": "codec_open",
            "file": "pjmedia/src/pjmedia-codec/opus.c"
        }
    }
]
vanir_signatures_modified 
"2026-07-15T17:59:39Z"