Description

Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe() function in src/cng.c that allows unauthenticated network-adjacent attackers to trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. A zero-length payload causes an integer underflow in the uint8_t filter order calculation, which wraps to 255 and is clamped to 10, causing the function to unconditionally read 11 bytes from a zero-byte buffer, resulting in media process termination or silent consumption of adjacent heap memory as reflection coefficients.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T18:18:12.510Z",
  "pubdate": "2026-08-17T18:18:12.510Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists in Belledonne Communications bcg729 through 1.1.2, specifically within the decodeSIDframe() function located in src/cng.c.\nThe vulnerability allows unauthenticated, network-adjacent attackers to trigger a heap read beyond buffer boundaries by transmitting a specially crafted, zero-length comfort-noise RTP payload.\nSuccessful exploitation of this flaw leads to media process termination resulting in a denial of service, or the potential silent consumption of adjacent heap memory as reflection coefficients.\nThe root cause stems from an integer underflow during the uint8_t filter order calculation when processing zero-length inputs.\nThis vulnerability poses a significant risk to voice-over-IP and telecommunication deployments utilizing the affected library, as remote attackers can disrupt real-time media streams without requiring prior authentication or user interaction.\nDefense requires applying vendor-supplied patches or updates beyond version 1.1.2 once available, alongside network-level monitoring and filtering of malformed RTP payloads.",
  "technicalDetails": "The vulnerability is localized to the decodeSIDframe() function within the src/cng.c source file of the Belledonne Communications bcg729 library, affecting versions up to 1.1.2.\nThe root cause of the flaw is an arithmetic integer underflow that occurs during the calculation of the uint8_t filter order when the application processes a zero-length comfort-noise RTP payload.\nUpon receiving a zero-length payload, the filter order calculation underflows, causing the numerical value to wrap around to 255.\nThis wrapped value is subsequently clamped to 10 by the internal logic of the function.\nDue to this invalid clamping mechanism, the function unconditionally attempts to read 11 bytes from an underlying zero-byte buffer.\nThe attack flow proceeds as follows: an unauthenticated, network-adjacent attacker crafts and transmits a malicious zero-length comfort-noise RTP payload targeting a vulnerable media endpoint running bcg729.\nThe receiving media process parses the incoming RTP packet and invokes the vulnerable decodeSIDframe() function to process the comfort-noise descriptor.\nThe absence of rigorous bounds checking on the payload length triggers the integer underflow and subsequent buffer boundary violation during the heap read operation.\nThis memory access violation results in either an immediate crash causing media process termination (Denial of Service) or the unintended exposure and consumption of adjacent heap memory contents interpreted as reflection coefficients.\nThe attack vector requires network adjacency to the vulnerable target, operates without authentication or privilege requirements, and directly targets the media processing pipeline."
}