PJSIP Opus Codec Heap Buffer Overflow Vulnerability

A heap buffer overflow vulnerability has been identified in the PJSIP multimedia communication library, specifically in versions of the library through 2.16. The issue arises in the Opus audio codec decoding process, where the buffer size for handling audio frames is not adequately validated. This flaw allows for the possibility of a heap buffer overflow, as the codec can receive frames larger than the allocated buffer can handle, leading to potential memory corruption or application crashes.

Impact

Exploitation of this vulnerability can cause a heap buffer overflow, which may result in memory corruption, allowing for potential arbitrary code execution, or causing the application to crash.

Remediation

Users can upgrade to PJSIP version 2.17, where this vulnerability has been patched. Alternatively, the Opus codec can be disabled to mitigate the issue.