CVE-2026-71980

Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe() function in src/cng.c that allows unauthenticated network-adjacent attackers to trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. A zero-length payload causes an integer underflow in the uint8_t filter order calculation, which wraps to 255 and is clamped to 10, causing the function to unconditionally read 11 bytes from a zero-byte buffer, resulting in media process termination or silent consumption of adjacent heap memory as reflection coefficients.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/BelledonneCommunications/bcg729/issues/23
https://www.linphone.org/
https://www.vulncheck.com/advisories/belledonne-communications-bcg729-out-of-bounds-read-via-decodesidframe
https://github.com/BelledonneCommunications/bcg729/issues/23

Configurations

No configuration.

History

23 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Belledonne Communications bcg729 hasta la versión 1.1.2 contiene una vulnerabilidad de lectura fuera de límites en la función decodeSIDframe() en src/cng.c que permite a atacantes no autenticados adyacentes a la red activar una lectura de pila más allá de los límites del búfer al enviar una carga útil RTP de ruido de confort de longitud cero. Una carga útil de longitud cero causa un subdesbordamiento de enteros en el cálculo del orden del filtro uint8_t, que se ajusta a 255 y se limita a 10, haciendo que la función lea incondicionalmente 11 bytes de un búfer de cero bytes, lo que resulta en la terminación del proceso de medios o el consumo silencioso de memoria de pila adyacente como coeficientes de reflexión.

Information

Published : 2026-08-17 18:18

Updated : 2026-10-23 16:10

NVD link : CVE-2026-71980

Mitre link : CVE-2026-71980

CVE.ORG link : CVE-2026-71980

JSON object : View

Products Affected

No product.

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-71980", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71980", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-17T18:12:40.286641Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/BelledonneCommunications/bcg729", "vendor": "BelledonneCommunications", "product": "bcg729", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.2"}], "packageURL": "pkg:github/BelledonneCommunications/bcg729", "defaultStatus": "affected"}]}], "published": "2026-08-17T18:18:12.510", "references": [{"url": "https://github.com/BelledonneCommunications/bcg729/issues/23", "source": "disclosure@vulncheck.com"}, {"url": "https://www.linphone.org/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/belledonne-communications-bcg729-out-of-bounds-read-via-decodesidframe", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/BelledonneCommunications/bcg729/issues/23", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe() function in src/cng.c that allows unauthenticated network-adjacent attackers to trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. A zero-length payload causes an integer underflow in the uint8_t filter order calculation, which wraps to 255 and is clamped to 10, causing the function to unconditionally read 11 bytes from a zero-byte buffer, resulting in media process termination or silent consumption of adjacent heap memory as reflection coefficients."}, {"lang": "es", "value": "Belledonne Communications bcg729 hasta la versi\u00f3n 1.1.2 contiene una vulnerabilidad de lectura fuera de l\u00edmites en la funci\u00f3n decodeSIDframe() en src/cng.c que permite a atacantes no autenticados adyacentes a la red activar una lectura de pila m\u00e1s all\u00e1 de los l\u00edmites del b\u00fafer al enviar una carga \u00fatil RTP de ruido de confort de longitud cero. Una carga \u00fatil de longitud cero causa un subdesbordamiento de enteros en el c\u00e1lculo del orden del filtro uint8_t, que se ajusta a 255 y se limita a 10, haciendo que la funci\u00f3n lea incondicionalmente 11 bytes de un b\u00fafer de cero bytes, lo que resulta en la terminaci\u00f3n del proceso de medios o el consumo silencioso de memoria de pila adyacente como coeficientes de reflexi\u00f3n."}], "lastModified": "2026-10-23T16:10:00.313", "sourceIdentifier": "disclosure@vulncheck.com"}