CVE-2026-40614: PJSIP Opus Buffer Overflow Vulnerability

CVE-2026-40614 Overview

CVE-2026-40614 is a heap buffer overflow vulnerability in PJSIP, a free and open source multimedia communication library written in C. The vulnerability exists in the Opus codec decode path where insufficient buffer size validation allows an attacker to trigger a heap buffer overflow when decoding specially crafted Opus audio frames.

The flaw occurs because the Forward Error Correction (FEC) decode buffers (dec_frame[].buf) were allocated based on a PCM-derived formula: (sample_rate/1000) * 60 * channel_cnt * 2. At 8 kHz mono configuration, this yields only 960 bytes, while codec_parse() can output encoded frames up to MAX_ENCODED_PACKET_SIZE (1280 bytes) via opus_repacketizer_out_range(). The three pj_memcpy() calls in codec_decode() copied input->size bytes without bounds checking, causing a heap buffer overflow.

Critical Impact

Successful exploitation of this heap buffer overflow could allow an attacker to execute arbitrary code or cause denial of service in applications using PJSIP for multimedia communication.

Affected Products

• PJSIP version 2.16 and earlier
• Applications utilizing PJSIP with Opus codec support
• VoIP and multimedia communication systems built on PJSIP

Discovery Timeline

• 2026-04-21 - CVE-2026-40614 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-40614

Vulnerability Analysis

This heap buffer overflow vulnerability (CWE-122) manifests in the Opus codec decode path within PJSIP's media handling subsystem. The core issue stems from a mismatch between the allocated buffer size and the maximum possible encoded frame size that can be processed.

The vulnerability requires local access with user interaction to exploit. An attacker could craft malicious Opus audio frames that exceed the expected buffer size, causing memory corruption when the codec_decode() function processes them. The impact is significant as it affects the confidentiality, integrity, and availability of the vulnerable system.

The buffer allocation formula assumes a maximum frame size based on PCM output requirements, but fails to account for the larger MAX_ENCODED_PACKET_SIZE constant that governs the actual encoded input data. This architectural oversight creates an exploitable condition whenever encoded frames approach or exceed the undersized buffer allocation.

Root Cause

The root cause is insufficient buffer size validation in the Opus codec implementation. Specifically:

1. The dec_frame[].buf buffers were sized using a PCM-derived calculation that produced inadequate allocations for certain configurations
2. At 8 kHz mono sampling, the allocation formula yields only 960 bytes
3. The codec_parse() function can output frames up to 1280 bytes (MAX_ENCODED_PACKET_SIZE)
4. The pj_memcpy() operations in codec_decode() lack bounds checking against the actual buffer capacity

Attack Vector

The attack vector requires local access to the system. An attacker could exploit this vulnerability by:

1. Crafting a malicious Opus audio stream with frames sized to exceed the allocated buffer
2. Delivering the malicious audio content to an application using PJSIP with Opus codec support
3. When the vulnerable codec_decode() function processes the oversized frame, the unchecked pj_memcpy() calls write beyond the heap buffer boundary
4. This heap corruption can potentially lead to arbitrary code execution or system crash

The security patch introduces a dec_frame_buf_size tracking variable to properly validate buffer boundaries during decode operations:

     unsigned                     dec_ptime_denum;
     pjmedia_frame                dec_frame[2];
     int                          dec_frame_index;
+    pj_size_t                    dec_frame_buf_size;
 };
 
 /* Codec factory instance */

Source: GitHub Commit Update

Detection Methods for CVE-2026-40614

Indicators of Compromise

• Unexpected application crashes in VoIP or multimedia applications using PJSIP
• Memory corruption indicators or heap-related errors in application logs
• Anomalous Opus audio frame sizes in network traffic analysis
• Unusual memory access patterns during Opus codec operations

Detection Strategies

• Monitor for heap corruption signatures in PJSIP-based applications
• Implement memory safety tools (AddressSanitizer, Valgrind) during testing to detect buffer overflows
• Analyze Opus audio frame sizes for values approaching or exceeding 1280 bytes
• Review application crash dumps for stack traces involving codec_decode() or pj_memcpy() functions

Monitoring Recommendations

• Enable detailed logging for Opus codec operations in PJSIP configurations
• Deploy runtime memory protection mechanisms on systems running PJSIP applications
• Monitor for abnormal resource consumption patterns in multimedia processing components
• Implement intrusion detection rules for malformed audio frame characteristics

How to Mitigate CVE-2026-40614

Immediate Actions Required

• Update PJSIP to a patched version that includes commit 17897e835818f8ee03b1806ddcd7b95ea16d2c0e
• Review all applications and services utilizing PJSIP with Opus codec support
• Prioritize patching for internet-facing VoIP and communication systems
• Consider temporarily disabling Opus codec support if patching is not immediately possible

Patch Information

The PJSIP project has released a security fix that introduces proper buffer size tracking. The patch adds a dec_frame_buf_size field to track the actual buffer capacity and ensure bounds checking during decode operations.

For detailed patch information, refer to:

• GitHub Security Advisory GHSA-j59p-4xrr-fp8g
• GitHub Commit Update

Workarounds

• Disable Opus codec support in PJSIP configuration if not required for operations
• Implement input validation at the application layer to reject oversized audio frames
• Deploy additional memory protection mechanisms such as ASLR and heap hardening
• Isolate PJSIP-based applications in sandboxed environments to limit exploitation impact

# Example: Disable Opus codec in PJSIP configuration
# In pjproject build configuration, disable Opus support:
./configure --disable-opus
make clean && make