CVE-2026-71980 Belledonne Communications bcg729 1.1.2 Out-of-Bounds Read via decodeSIDframe()
Attackers can cause denial of service or leak heap memory by sending zero-length RTP payloads to the bcg729 audio codec library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-71980?
CVE-2026-71980 is a high-severity vulnerability in BelledonneCommunications bcg729, published on 17 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe() function in src/cng.c that allows unauthenticated network-adjacent attackers to trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. A zero-length payload causes an integer underflow in the uint8_t filter order calculation, which wraps to 255 and is clamped to 10, causing the function to unconditionally read 11 bytes from a zero-byte buffer, resulting in media process termination or silent consumption of adjacent heap memory as reflection coefficients.
Weakness: CWE-125
Which versions are affected by CVE-2026-71980?
How do I fix CVE-2026-71980?
No fix has been published for CVE-2026-71980 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-71980 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-71980 exists.
Sources
Also known as GHSA-r839-2gfx-g34h.