CVE-2026-71980
Received Received - Intake

Out-of-Bounds Read in bcg729 Audio Codec Library

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description
Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe() function in src/cng.c that allows unauthenticated network-adjacent attackers to trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. A zero-length payload causes an integer underflow in the uint8_t filter order calculation, which wraps to 255 and is clamped to 10, causing the function to unconditionally read 11 bytes from a zero-byte buffer, resulting in media process termination or silent consumption of adjacent heap memory as reflection coefficients.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-71980
EUVD
EUVD-2026-60315

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
belledonne_communications bcg729 to 1.1.2 (inc)
belledonne_communications bcg729 1.1.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an out-of-bounds read vulnerability in the bcg729 library's decodeSIDframe() function. When processing a zero-length comfort-noise RTP payload, an integer underflow occurs in the filter order calculation, causing the function to read 11 bytes from an empty buffer. This can crash the media process or silently consume adjacent heap memory.

Detection Guidance

To detect this vulnerability, monitor for crashes or media processing failures in systems using bcg729 1.1.2 or earlier when processing RTP comfort-noise packets. Check logs for heap corruption errors or application termination during media decoding. Use network traffic analysis tools like Wireshark to inspect RTP packets for zero-length payload type 13 comfort-noise frames.

Impact Analysis

The vulnerability allows unauthenticated attackers on the same network to crash media processing software using bcg729 or potentially access adjacent memory. This could disrupt VoIP calls or other real-time communication services that rely on the library.

Compliance Impact

This vulnerability does not directly impact GDPR or HIPAA compliance as it does not involve unauthorized data access, disclosure, or processing of personal health information. The issue causes media process termination or heap memory consumption but does not expose sensitive data or violate privacy requirements under these standards.

Mitigation Strategies

Immediately update bcg729 to the latest patched version. If an update is unavailable, implement network-level filtering to block zero-length RTP comfort-noise packets (payload type 13) at the firewall or SIP proxy. Disable comfort-noise processing in affected applications if possible. Monitor systems for signs of exploitation or crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71980. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart