CVE-2026-40614Disclosure(pjsip / pjsip)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is a buffer overflow when decoding Opus audio frames due to insufficient buffer size validation in the Opus codec decode path. The FEC decode buffers (dec_frame[].buf) were allocated based on a PCM-derived formula: (sample_rate/1000) * 60 * channel_cnt * 2. At 8 kHz mono this yields only 960 bytes, but codec_parse() can output encoded frames up to MAX_ENCODED_PACKET_SIZE (1280) bytes via opus_repacketizer_out_range(). The three pj_memcpy() calls in codec_decode() copied input->size bytes without bounds checking, causing a heap buffer overflow.

pjsip CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Weakness type (CWE)

CWE-122

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

pjsip

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-04-21); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

pjsip

Products

pjsip

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

Vulmon Vulnerability Feed@VulmonFeeds171d
Disclosure
CVE-2026-40614 Buffer Overflow in PJSIP Opus Audio Codec Decode Path Version 2.1... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40614 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The tweet announces CVE-2026-40614, identifies a buffer overflow in the PJSIP Opus Audio Codec Decoder v2.1, and links to detailed vulnerability information.
0000043
4.0K followersView on X
CVE@CVEnew171d
Disclosure
CVE-2026-40614 PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is a buffer overflow when decoding Opus audio frames due to … https://www.cve.org/CVERecord?id=CVE-2026-40614
Post summary
The snippet announces a buffer-overflow vulnerability (CVE‑2026‑40614) affecting PJSIP versions 2.16 and earlier during Opus audio decoding.
00000152
57.2K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	pjsip	pjsip	-	-	-

Explore more

Back to dashboard pjsip CVEs pjsip vulnerabilities