CVE-2025-65102CWE-120

CVE-2025-65102

published November 22, 2025

CVSS

8.7

EPSS

Percentile

25.9

In the wild

Unconfirmed

What it is

PJSIP is a free and open source multimedia communication library. Prior to version 2.16, Opus PLC may zero-fill the input frame as long as the decoder ptime, while the input frame length, which is based on stream ptime, may be less than that. This issue affects PJSIP users who use the Opus audio codec in receiving direction. The vulnerability can lead to unexpected application termination due to a memory overwrite. This issue has been patched in version 2.16.

The record

Technical detail

CVSS: 8.7 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00338 · 25.9th percentile
Weakness: CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published: 2025-11-22T03:16Z

References (2)

https://github.com/pjsip/pjproject/commit/6e9bd2e7d25bba26f852771b40693f45da14fa8f · [email protected]https://github.com/pjsip/pjproject/security/advisories/GHSA-w5vr-39x7-h8g5 · [email protected]

EPSS history

Timeline

21 NOV 21:36Z
PJSIP is vulnerable to buffer overflow in Opus PLC
cvelistv5