Executive brief
Belledonne Communications bcg729 is a G.729 audio codec library widely used in VoIP applications like Linphone to compress voice calls. An attacker on the network can send a specially crafted RTP voice packet with a zero-length comfort-noise payload to trigger an out-of-bounds memory read, causing the media process to crash and interrupting active calls.
Technical details
The vulnerability is an out-of-bounds heap read in the decodeSIDframe() function in src/cng.c. When processing RFC 3389 comfort-noise (CN) RTP payloads, the function computes filter order as (bitStreamLength - 1) in a uint8_t. A zero-length payload causes integer underflow to 255, clamped to 10, but the code unconditionally reads 11 bytes from the buffer without validating its size. The attack vector is unauthenticated network-adjacent RTP injection (e.g., via SIP stacks using mediastreamer). On systems with memory hardening or guard pages, the read faults and terminates the media process (denial of service). The vulnerability was reported with a suggested fix to reject zero-length payloads before underflow.
Affected products
- Belledonne Communications bcg729 through 1.1.2
Timeline
- 2026-08-17: disclosed
- 2026-08-13: other: coordinated-disclosure issue opened on GitHub