Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe() function in src/cng.c that allows unauthenticated network-adjacent attackers to trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. A zero-length payload causes an integer underflow in the uint8_t filter order calculation, which wraps to 255 and is clamped to 10, causing the function to unconditionally read 11 bytes from a zero-byte buffer, resulting in media process termination or silent consumption of adjacent heap memory as reflection coefficients.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
References
History
Mon, 17 Aug 2026 18:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe() function in src/cng.c that allows unauthenticated network-adjacent attackers to trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. A zero-length payload causes an integer underflow in the uint8_t filter order calculation, which wraps to 255 and is clamped to 10, causing the function to unconditionally read 11 bytes from a zero-byte buffer, resulting in media process termination or silent consumption of adjacent heap memory as reflection coefficients. | |
| Title | Belledonne Communications bcg729 1.1.2 Out-of-Bounds Read via decodeSIDframe() | |
| Weaknesses | CWE-125 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-08-17T18:12:49.074Z
Reserved: 2026-08-08T16:43:04.178Z
Link: CVE-2026-71980
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-17T18:18:12.510
Modified: 2026-08-17T19:16:38.063
Link: CVE-2026-71980
Redhat
No data.
OpenCVE Enrichment
No data.