CVE-2025-65102
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-21

Last updated on: 2025-11-21

Assigner: GitHub, Inc.

Description
PJSIP is a free and open source multimedia communication library. Prior to version 2.16, Opus PLC may zero-fill the input frame as long as the decoder ptime, while the input frame length, which is based on stream ptime, may be less than that. This issue affects PJSIP users who use the Opus audio codec in receiving direction. The vulnerability can lead to unexpected application termination due to a memory overwrite. This issue has been patched in version 2.16.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-21
Last Modified
2025-11-21
Generated
2026-06-16
AI Q&A
2025-11-22
EPSS Evaluated
2026-06-15
NVD
CVE-2025-65102
EUVD
EUVD-2025-198513
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
pjsip pjsip *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in PJSIP versions prior to 2.16 when using the Opus audio codec in the receiving direction. The issue is that Opus Packet Loss Concealment (PLC) may zero-fill the input frame based on the decoder's packet time (ptime), but the actual input frame length is based on the stream's ptime, which can be shorter. This mismatch can cause a memory overwrite, potentially leading to unexpected application termination.

Impact Analysis

The vulnerability can cause unexpected application termination due to memory overwrite when using the Opus codec in PJSIP. This could lead to denial of service or instability in applications relying on PJSIP for multimedia communication.

Mitigation Strategies

Upgrade PJSIP to version 2.16 or later, as this version contains the patch that fixes the vulnerability related to the Opus audio codec. Avoid using vulnerable versions prior to 2.16 to prevent unexpected application termination due to memory overwrite.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-65102. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart