CVE-2025-65102

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-21

Last updated on: 2025-11-21

Assigner: GitHub, Inc.

Description

PJSIP is a free and open source multimedia communication library. Prior to version 2.16, Opus PLC may zero-fill the input frame as long as the decoder ptime, while the input frame length, which is based on stream ptime, may be less than that. This issue affects PJSIP users who use the Opus audio codec in receiving direction. The vulnerability can lead to unexpected application termination due to a memory overwrite. This issue has been patched in version 2.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-21

Last Modified

2025-11-21

Generated

2026-07-06

AI Q&A

2025-11-22

EPSS Evaluated

2026-07-05

NVD

CVE-2025-65102

EUVD

EUVD-2025-198513

Affected Vendors & Products

Vendor	Product	Version / Range
pjsip	pjsip	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in PJSIP versions prior to 2.16 when using the Opus audio codec in the receiving direction. The issue is that Opus Packet Loss Concealment (PLC) may zero-fill the input frame based on the decoder's packet time (ptime), but the actual input frame length is based on the stream's ptime, which can be shorter. This mismatch can cause a memory overwrite, potentially leading to unexpected application termination.

Impact Analysis

The vulnerability can cause unexpected application termination due to memory overwrite when using the Opus codec in PJSIP. This could lead to denial of service or instability in applications relying on PJSIP for multimedia communication.

Mitigation Strategies

Upgrade PJSIP to version 2.16 or later, as this version contains the patch that fixes the vulnerability related to the Opus audio codec. Avoid using vulnerable versions prior to 2.16 to prevent unexpected application termination due to memory overwrite.

Hi! I’m here to help you understand CVE-2025-65102. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70