PJSIP versions 2.16 and earlier contain a heap buffer overflow in the Opus codec decode path caused by insufficient buffer size validation when allocating FEC decode buffers. The three memcpy calls copy the full input frame size without checking bounds, so a maliciously sized frame can overwrite adjacent heap memory. The flaw is a classic CWE‑122 situation that can allow an attacker to execute arbitrary code or crash the application.

The affected product is the PJSIP multimedia library (pjproject) released before version 2.17. Any deployment that uses pjsip 2.16 or earlier for Opus audio decoding is vulnerable. No additional vendor or product details are provided beyond the pjproject identifier.

The CVSS score of 8.5 indicates a high severity flaw with significant impact. EPSS data is not available, so the exploitation likelihood is uncertain, but the vulnerability is not listed in CISA KEV. The likely attack vector is through network traffic, as an attacker can send crafted Opus frames to any service using the vulnerable decoder, potentially leading to arbitrary code execution. The absence of a mitigation in the advisory suggests that deploying the fixed version is critical for reducing risk.