An out-of-bounds read in the decodeSIDframe() function of Belledonne Communications bcg729 allows an attacker to read beyond a zero-byte buffer when a zero-length comfort-noise RTP payload is received. The integer underflow during filter order calculation causes the function to read eleven bytes from an empty buffer, potentially leading to media processing termination or the accidental disclosure of adjacent heap memory. This flaw results in memory corruption that can crash the application or silently consume unrelated data, compromising stability and possibly information confidentiality.

Belledonne Communications bcg729 versions up to and including 1.1.2 are affected. The vulnerability applies to all builds of the library that use the vulnerable decodeSIDframe() implementation.

With a CVSS score of 8.7, the flaw is considered high severity. Although no EPSS score is provided and the vulnerability is not listed in KEV, the attack vector is network adjacent, allowing unauthenticated attackers that can reach the RTP stream to send crafted zero-length comfort-noise packets. The exploit requires only network access to the media transport channel and can be performed without authentication, resulting in a high likelihood of exploitation in exposed deployments.