CyberRota Analysis
AI-GeneratedThe vulnerability affects Belledonne Communications' bcg729 versions up to 1.1.2, specifically in the decodeSIDframe() function, where an out-of-bounds read can be triggered by sending a zero-length comfort-noise RTP payload. This flaw allows unauthenticated network-adjacent attackers to exploit an integer underflow, potentially leading to media process termination or unauthorized access to adjacent heap memory. Organizations using this software should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe() function in src/cng.c that allows unauthenticated network-adjacent attackers to trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. A zero-length payload causes an integer underflow in the uint8_t filter order calculation, which wraps to 255 and is clamped to 10, causing the function to unconditionally read 11 bytes from a zero-byte buffer, resulting in media process termination or silent consumption of adjacent heap memory as reflection coefficients.