Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_M
CVE-2026-40614PJSIP: Heap buffer overflow in Opus codec decoding
High 8.5
In plain English
A high-severity heap buffer overflow in pjproject from pjsip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is a buffer overflow when decoding Opus audio frames due to insufficient buffer size validation in the Opus codec decode path. The FEC decode buffers (dec_frame[].buf) were allocated based on a PCM-derived formula: (sample_rate/1000) * 60 * channel_cnt * 2. At 8 kHz mono this yields only 960 bytes, but codec_parse() can output encoded frames up to MAX_ENCODED_PACKET_SIZE (1280) bytes via opus_repacketizer_out_range(). The three pj_memcpy() calls in codec_decode() copied input->size bytes without bounds checking, causing a heap buffer overflow.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | pjproject | 2.17-r0 | ALPINE-CVE-2026-40614 |
| Debian:14 | asterisk | 1:22.10.0+dfsg+~cs6.17.60671434-1 | DEBIAN-CVE-2026-40614 |
| Ubuntu:22.04:LTS | asterisk | no fix listed | UBUNTU-CVE-2026-40614 |
| Ubuntu:24.04:LTS | asterisk | no fix listed | UBUNTU-CVE-2026-40614 |
| Ubuntu:25.10 | asterisk | no fix listed | UBUNTU-CVE-2026-40614 |
| Ubuntu:26.04:LTS | asterisk | no fix listed | UBUNTU-CVE-2026-40614 |
| Ubuntu:26.10 | asterisk | no fix listed | UBUNTU-CVE-2026-40614 |
Affected products (as reported)
Weakness: CWE-122 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N