CVE-2025-65102 PJSIP is vulnerable to buffer overflow in Opus PLC
A buffer overflow in PJSIP's Opus PLC handling can cause unexpected application termination, affecting users receiving Opus audio.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-65102?
CVE-2025-65102 is a high-severity memory corruption vulnerability in pjsip pjproject, published on 21 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PJSIP is a free and open source multimedia communication library. Prior to version 2.16, Opus PLC may zero-fill the input frame as long as the decoder ptime, while the input frame length, which is based on stream ptime, may be less than that. This issue affects PJSIP users who use the Opus audio codec in receiving direction. The vulnerability can lead to unexpected application termination due to a memory overwrite. This issue has been patched in version 2.16.
Weakness: CWE-120
Which versions are affected by CVE-2025-65102?
How do I fix CVE-2025-65102?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-65102 being exploited?
There is no known exploitation of CVE-2025-65102 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2025-65102, DEBIAN-CVE-2025-65102, GHSA-w5vr-39x7-h8g5, UBUNTU-CVE-2025-65102.