{"id":"CVE-2025-65102","summary":"PJSIP is vulnerable to buffer overflow in Opus PLC","details":"PJSIP is a free and open source multimedia communication library. Prior to version 2.16, Opus PLC may zero-fill the input frame as long as the decoder ptime, while the input frame length, which is based on stream ptime, may be less than that. This issue affects PJSIP users who use the Opus audio codec in receiving direction. The vulnerability can lead to unexpected application termination due to a memory overwrite. This issue has been patched in version 2.16.","aliases":["GHSA-w5vr-39x7-h8g5"],"modified":"2026-08-12T15:14:37.893209Z","published":"2025-11-21T21:36:58.375Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-120"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65102.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65102.json"},{"type":"ADVISORY","url":"https://github.com/pjsip/pjproject/security/advisories/GHSA-w5vr-39x7-h8g5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65102"},{"type":"FIX","url":"https://github.com/pjsip/pjproject/commit/6e9bd2e7d25bba26f852771b40693f45da14fa8f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pjsip/pjproject","events":[{"introduced":"0"},{"fixed":"6e9bd2e7d25bba26f852771b40693f45da14fa8f"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.16"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["2.15","2.14","2.13","2.12","2.11","2.10"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-65102.json","vanir_signatures_modified":"2026-08-12T15:14:37Z","vanir_signatures":[{"id":"CVE-2025-65102-41a388f9","signature_type":"Line","signature_version":"v1","source":"https://github.com/pjsip/pjproject/commit/6e9bd2e7d25bba26f852771b40693f45da14fa8f","target":{"file":"pjmedia/src/pjmedia-codec/opus.c"},"deprecated":false,"digest":{"line_hashes":["266677233653437687354229639551213848494","65103337288911274990102013824264095072","208172665598254958365738996672419436578","16031429547521329963943737443720001478","145573090340297391084704162591241597395","81720341765190602602281032603157208154","255579187264193398118188440222486814249","135007708480694161233127367069617497606"],"threshold":0.9}},{"digest":{"line_hashes":["122694558069801170264860034441229696318","129664248851347442436969382803161937776","159046775279221147291935734091644058084","149005411813299949332515910750044666457","326684543566527255901340159366239667640","337264212753703434321063300238456276295","145476484519384861993549689529315840763","153739624830494098136309316217373918845","207116757588732938147593473684204256673","156397106107136441385670546955028702098","319740107819148200395124785553104509673","162690846469883172405285835886088180203","272008023884124690660757730539583274499","242300194993340498891905159267008455414","151942415283499532786423084633024329392","277816535385539487655056634619671715147","232550363193913262310996000144101686723","226907591253604149687130649758222311897","258657943316001050738949932151467048738","296231278770832101922998457610149165819","109315122074318703949549751098487858245","163622078261635695470849442778749687812","66708161159865053806317299962033553195","93090182610298779569102157457108926030","260647573654027243403635591420185588481","316262812100567710741656621744195993400","193975255802107508773010058871464869573","6621217610933576917539348749374800338","216616189436116083358306662673779390218","13433493938329903456426822240493926917","167825190159718900155772899276113110274","13522382534627691585181350937158453147","58390482627251585418662440568090968166","164464568104048288652567625868216992350","93122271705184084418664886807789998945","107134357973151475649438088860630541471","299886988703060691584287819039654578323","264795615782846125006352902990869686294","130253418581540125665010099148611240200","89403158925667848531099670990388157234","33413498460271530756753944561772263774","146533755909091879550979207138945575220","50097136764630111581401056630024655365","277816535385539487655056634619671715147","232550363193913262310996000144101686723","25778086189755759715407680212213647927","106878453692657096885352253877196501876","118489295280204605156573422060363356748","141574388173526644706045176374645129116","109315122074318703949549751098487858245","163622078261635695470849442778749687812","302545135485801851496595226463806426666","19349567768002172447282873029257442396","56245617646768187735540368123993955591","129599692267079976120437848810246070908","152759636892921202390294956043858639445","26536131523176688006593826167014096860","103554719717867850641889036187416711869","139057044368259788629483439196453677420","300599983526422109562897609466283387099","4224808553793635992679829771373023837","256514919001375477111753233079188075788","116744148056288543763612278403784747763","131029949637804238960845034486909266210","282120346126332799883714378113514484564","52130217643159043840390761528281639891","118455725186244670893983723524220172246","106921301880379241465632793889295938025","247713562870296098448259681296764837026","101738587881292771384037958173933176374","177881019581279403060315200758343698167","86803932862788322286199425386053004182","277816535385539487655056634619671715147","232550363193913262310996000144101686723","25778086189755759715407680212213647927","106878453692657096885352253877196501876","118489295280204605156573422060363356748","141574388173526644706045176374645129116","109315122074318703949549751098487858245","163622078261635695470849442778749687812","302545135485801851496595226463806426666","19349567768002172447282873029257442396","56245617646768187735540368123993955591","129599692267079976120437848810246070908","152759636892921202390294956043858639445","26536131523176688006593826167014096860","103554719717867850641889036187416711869","139057044368259788629483439196453677420","180760496692460484288002395830827693878","234988713515572392119678285908259606374","116744148056288543763612278403784747763","131029949637804238960845034486909266210","282120346126332799883714378113514484564","52130217643159043840390761528281639891","118455725186244670893983723524220172246","114170595471101114675837643847203773773","147499635420781371363901726710084487993","310411202807638048511965163154935722620","168450826308728891272083756797255575504","25005463461403813655627602462192721976","157494972424056837964883166068470668042","142261766084648114917784546904607621981","219726299304241038965317703991508240840","159070414734074949627600781541517588275","151253520474011043686410061043385296506","304538171568077395955393561534126392485","328357405969887172467810130357428273220"],"threshold":0.9},"id":"CVE-2025-65102-490d4e9a","signature_type":"Line","signature_version":"v1","source":"https://github.com/pjsip/pjproject/commit/6e9bd2e7d25bba26f852771b40693f45da14fa8f","target":{"file":"pjmedia/src/pjmedia/stream.c"},"deprecated":false},{"target":{"function":"codec_recover","file":"pjmedia/src/pjmedia-codec/opus.c"},"deprecated":false,"digest":{"function_hash":"18095722557973322055090563893942528","length":1572},"id":"CVE-2025-65102-7982119a","signature_type":"Function","signature_version":"v1","source":"https://github.com/pjsip/pjproject/commit/6e9bd2e7d25bba26f852771b40693f45da14fa8f"},{"source":"https://github.com/pjsip/pjproject/commit/6e9bd2e7d25bba26f852771b40693f45da14fa8f","target":{"file":"pjmedia/src/pjmedia/stream.c","function":"get_frame"},"deprecated":false,"digest":{"function_hash":"157483576804071798368107574385551929692","length":6155},"id":"CVE-2025-65102-c0e46a05","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}