CVE-2026-40614

OVERVIEW CVE-2026-40614 affects PJSIP versions 2.16 and earlier, a widely-used open-source multimedia communication library written in C. The vulnerability is a heap buffer overflow in the Opus audio codec decode path, caused by insufficient validation of buffer sizes during FEC (Forward Error Correction) frame decoding. The FEC decode buffers are allocated using a formula that produces only 960 bytes at 8 kHz mono, but the codec can receive encoded frames up to 1280 bytes, causing the three memcpy() operations in codec_decode() to overflow the allocated heap memory without bounds checking. SEVERITY The vulnerability presents a network-based attack vector requiring no special privileges or user interaction. Attack complexity is low, as an attacker need only send specially crafted Opus audio frames to trigger the overflow. The potential impact is significant, including possible remote code execution, denial of service, or information disclosure through heap memory corruption. With a FAUCET Risk Score of 41.0/100, this represents a moderate-to-high risk vulnerability, though notably the CVSS and EPSS scores indicate it ranks lower than most CVEs in terms of statistical exploitability. EXPLOITATION STATUS The vulnerability is currently marked as Active on the KEV (Known Exploited Vulnerabilities) Hot List, indicating active exploitation in the wild. However, no formal exploit code appears to be publicly available in mainstream repositories. Community attention remains relatively limited given the specialized nature of PJSIP and its deployment primarily in VoIP and telecommunications infrastructure rather than consumer-facing applications.