EUVD-2026-60315
GHSA-r839-2gfx-g34h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description specifies 'network-adjacent' attackers so AV:A, not AV:N; heap read data never returned to attacker so C:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe() function in src/cng.c that allows unauthenticated network-adjacent attackers to trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. A zero-length payload causes an integer underflow in the uint8_t filter order calculation, which wraps to 255 and is clamped to 10, causing the function to unconditionally read 11 bytes from a zero-byte buffer, resulting in media process termination or silent consumption of adjacent heap memory as reflection coefficients.
AnalysisAI
Out-of-bounds heap read in Belledonne Communications bcg729 through 1.1.2 allows unauthenticated network-adjacent attackers to crash the media process or silently corrupt G.729 comfort-noise generation by delivering a single zero-length SID RTP payload. The root cause is an integer underflow in uint8_t arithmetic inside decodeSIDframe() that causes the function to unconditionally attempt reading 11 bytes from a zero-byte heap buffer, resulting in media process termination or consumption of adjacent heap memory as LP filter reflection coefficients. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be running bcg729 1.1.2 or earlier and must have negotiated G.729 with Annex B (silence suppression / comfort noise) support in the SDP exchange - sessions using G.729 without Annex B or entirely different codecs do not exercise the vulnerable decodeSIDframe() path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The reported CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) reflects a worst-case network accessibility assumption; however, independent assessment places the realistic attack vector at network-adjacent (AV:A), since exploitation requires the ability to inject an RTP packet into an established media session - a constraint that materially limits the exposed attack surface compared to a pure internet-facing HTTP service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis; the upstream issue is tracked at https://github.com/BelledonneCommunications/bcg729/issues/23 and operators should monitor it for a fix release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running bcg729 version 1.1.2 and earlier through inventory scans and dependency audits; assess which systems are exposed to untrusted network sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today