CVE-2026-71980: bcg729 Buffer Overflow Vulnerability

CVE-2026-71980 Overview

CVE-2026-71980 is an out-of-bounds read vulnerability in Belledonne Communications bcg729 through version 1.1.2, an open-source implementation of the G.729 audio codec used in Voice over IP (VoIP) applications including Linphone. The flaw resides in the decodeSIDframe() function in src/cng.c, which handles comfort noise generation (CNG) for Silence Insertion Descriptor (SID) frames. Unauthenticated network-adjacent attackers can trigger the vulnerability by sending a zero-length comfort-noise Real-time Transport Protocol (RTP) payload. Successful exploitation causes media process termination or silent consumption of adjacent heap memory as reflection coefficients, disrupting VoIP call availability.

Critical Impact
A single crafted zero-length RTP comfort-noise payload can crash media processing in any application linking bcg729 ≤ 1.1.2, denying service to VoIP endpoints and softphones.

Affected Products

Belledonne Communications bcg729 versions up to and including 1.1.2
Linphone softphone builds bundling vulnerable bcg729 releases
Third-party VoIP applications and gateways statically or dynamically linking bcg729

Discovery Timeline

2026-08-17 - CVE-2026-71980 published to the National Vulnerability Database (NVD)
2026-08-17 - Last updated in NVD database

Technical Details for CVE-2026-71980

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] arising from an integer underflow during codec frame decoding. When bcg729 processes a comfort-noise RTP payload of zero bytes, the decodeSIDframe() function computes a Linear Prediction (LP) filter order value from the payload length. The calculation subtracts a fixed offset from the payload size and stores the result in a uint8_t variable. A zero-length input causes the subtraction to underflow, wrapping the unsigned 8-bit value to 255.

Subsequent bounds clamping caps the filter order at 10 rather than rejecting the invalid input. The function then unconditionally reads 11 bytes from a zero-byte payload buffer to populate reflection coefficient arrays. The read walks past the heap allocation into adjacent memory, and the retrieved bytes are silently consumed as codec parameters. This produces either a media process crash or corrupted audio synthesis, depending on the surrounding heap state.

Root Cause

The root cause is missing input length validation combined with an unchecked arithmetic operation on an unsigned narrow integer type. decodeSIDframe() trusts the RTP payload length without enforcing a minimum size before deriving the filter order, and the clamp to 10 masks the underflow instead of rejecting the frame.

Attack Vector

Exploitation requires the attacker to deliver a single RTP packet containing a zero-length G.729 comfort-noise SID payload to a target endpoint that decodes it with bcg729. No authentication or user interaction is required. Any network position permitting RTP delivery — including established call media paths, SIP trunks, or misconfigured media relays — is sufficient.

Refer to the VulnCheck Advisory: BCG729 Out-of-Bounds Read and the GitHub Issue Discussion for additional technical detail.

Detection Methods for CVE-2026-71980

Indicators of Compromise

Unexpected termination or restart of media processes (softphone, media gateway, PBX bridge) linked against bcg729
RTP packets with G.729 comfort-noise (SID) payload types carrying a zero-byte payload length
Heap corruption or ASan/UBSan reports referencing decodeSIDframe in src/cng.c

Detection Strategies

Deploy deep packet inspection or session border controller (SBC) rules to flag RTP frames with zero-length payloads on codec streams negotiated as G.729 Annex B
Correlate softphone or media server crash telemetry with concurrent inbound RTP flows from untrusted peers
Run fuzzing harnesses or replay captured malformed SID frames against instrumented bcg729 builds to validate detection coverage

Monitoring Recommendations

Enable crash reporting and core dump collection on hosts running Linphone, mediastreamer2, or other bcg729 consumers
Alert on repeated media process restarts on VoIP endpoints and back-end media relays
Track RTP payload length distributions per codec to surface anomalous zero-length comfort-noise frames

How to Mitigate CVE-2026-71980

Immediate Actions Required

Inventory all applications, SDKs, and appliances that bundle bcg729 version 1.1.2 or earlier
Restrict RTP ingress to trusted peers and enforce SRTP with authenticated media where feasible
Terminate media at a hardened SBC that validates RTP payload lengths before forwarding G.729 streams to endpoints

Patch Information

At the time of publication, no fixed release is listed in the NVD entry for CVE-2026-71980. Monitor the Belledonne Communications bcg729 issue tracker and the Linphone Official Website for updated releases, and rebuild any downstream projects that statically link bcg729 once a patched version becomes available.

Workarounds

Disable G.729 Annex B comfort-noise negotiation in SIP/SDP profiles where operationally acceptable
Prefer alternative codecs (Opus, G.711) on affected endpoints until a patched bcg729 release is deployed
Apply local input validation patches that reject SID payloads shorter than the minimum expected filter-order byte count in decodeSIDframe()

bash

# Configuration example: disable G.729 codec in a Linphone-based client (linphonerc)
[sound]
codec_priority_policy=basic

[audio_codec_0]
mime=G729
rate=8000
channels=1
enabled=0