Vulnerability · Published Aug 17, 2026 · Assigned by VulnCheck
CVE-2026-71980Belledonne Communications bcg729 1.1.2 Out-of-Bounds Read via decodeSIDframe()
High 7.5
In plain English
A high-severity out-of-bounds read in bcg729 from BelledonneCommunications. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Official description
Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe() function in src/cng.c that allows unauthenticated network-adjacent attackers to trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. A zero-length payload causes an integer underflow in the uint8_t filter order calculation, which wraps to 255 and is clamped to 10, causing the function to unconditionally read 11 bytes from a zero-byte buffer, resulting in media process termination or silent consumption of adjacent heap memory as reflection coefficients.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BelledonneCommunications | bcg729 | 0 – through 1.1.2 |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- Researcher Disclosure issue-tracking
- Project Webpage product
- https://www.vulncheck.com/advisories/belledonne-communications-bcg729-out-of-bounds-read-via-decodesidframe third-party-advisory