CVE-2025-71264: Mumble DoS Vulnerability

CVE-2025-71264 Overview

CVE-2025-71264 is an out-of-bounds read vulnerability (CWE-125) affecting Mumble, the popular open-source voice over IP (VoIP) application. Versions prior to 1.6.870 are susceptible to an out-of-bounds array access that can result in denial of service through client crash.

Critical Impact
Attackers can exploit this vulnerability to crash Mumble client applications, disrupting voice communications for affected users.

Affected Products

Mumble versions prior to 1.6.870
Mumble clients with vulnerable Opus audio decoding functionality
Systems running unpatched Mumble VoIP software

Discovery Timeline

2026-03-16 - CVE-2025-71264 published to NVD
2026-03-16 - Last updated in NVD database

Technical Details for CVE-2025-71264

Vulnerability Analysis

This vulnerability stems from improper bounds checking in Mumble's audio processing subsystem. The flaw occurs within the Opus audio codec decoding implementation, specifically in the AudioOutputSpeech.cpp component. The out-of-bounds array access can be triggered during audio frame processing, where malformed or specially crafted audio data could cause the application to read beyond allocated memory boundaries.

The vulnerability requires network access but has high attack complexity, meaning exploitation depends on specific conditions being met during audio data processing. While the impact is limited to availability (denial of service), successful exploitation results in client application crashes without requiring user interaction or special privileges.

Root Cause

The root cause lies in the Opus audio frame handling logic within src/mumble/AudioOutputSpeech.cpp. The code processes audio frames where Opus's definition of a "frame" differs from standard audio terminology. In Opus, a frame represents samples spanning a time period (2.5, 5, 10, 20, 40, or 60 ms of audio data), which can be stereo or mono. The vulnerability manifests when frame size calculations do not properly validate array boundaries during decoding operations, leading to potential out-of-bounds memory access.

Attack Vector

The attack vector is network-based, requiring an attacker to send malformed audio data to a vulnerable Mumble client. The high attack complexity indicates that specific conditions must be met for successful exploitation. An attacker could potentially craft malicious audio streams that trigger the out-of-bounds read during Opus decoding, causing the client application to crash.

cpp

// Security patch from AudioOutputSpeech.cpp
// Source: https://github.com/mumble-voip/mumble/commit/ff2a2332cccb267721553f09c0ded4de880622e0

 
 	// opus's "frame" means different from normal audio term "frame"
 	// normally, a frame means a bundle of only one sample from each channel,
-	// e.Global::get(). for a stereo stream, ...[LR]LRLRLR.... where the bracket indicates a frame
+	// e.g. for a stereo stream, ...[LR]LRLRLR.... where the bracket indicates a frame
 	// in opus term, a frame means samples that span a period of time, which can be either stereo or mono
-	// e.Global::get(). ...[LRLR....LRLR].... or ...[MMMM....MMMM].... for mono stream
+	// e.g. ...[LRLR....LRLR].... or ...[MMMM....MMMM].... for mono stream
 	// opus supports frames with: 2.5, 5, 10, 20, 40 or 60 ms of audio data.
-	// sample rate / 100 means 10ms mono audio data per frame.
+	// sample rate / 100 means 10ms (0.01s) mono audio data points (samples) per frame.
 	iFrameSizePerChannel = iFrameSize = iSampleRate / 100; // for mono stream
 
 	assert(m_codec == Mumble::Protocol::AudioCodec::Opus);

Source: GitHub Mumble Commit Details

Detection Methods for CVE-2025-71264

Indicators of Compromise

Unexpected Mumble client crashes during voice communication sessions
Application crash logs referencing AudioOutputSpeech.cpp or Opus decoding functions
Memory access violation errors in Mumble process crash dumps

Detection Strategies

Monitor for abnormal Mumble client terminations across endpoints
Implement application crash reporting to identify patterns of exploitation attempts
Review network traffic for malformed audio streams targeting Mumble clients

Monitoring Recommendations

Deploy endpoint detection to alert on repeated Mumble application crashes
Correlate crash events with network connections to identify potential attack sources
Maintain centralized logging of VoIP application stability metrics

How to Mitigate CVE-2025-71264

Immediate Actions Required

Upgrade Mumble to version 1.6.870 or later immediately
Review deployment inventory to identify all systems running vulnerable Mumble versions
Consider temporarily restricting Mumble usage on critical systems until patching is complete

Patch Information

The vulnerability has been addressed in Mumble version 1.6.870. The fix corrects the Opus audio frame decoding issues that led to the out-of-bounds array access. Security patches and detailed information are available through the following resources:

Workarounds

No official workarounds are available; upgrading to the patched version is the recommended remediation
Consider network segmentation to limit exposure of Mumble clients to untrusted sources
Implement application whitelisting to prevent execution of vulnerable Mumble versions

bash

# Verify Mumble version on Linux systems
mumble --version

# Update Mumble via package manager (Debian/Ubuntu)
sudo apt update && sudo apt upgrade mumble