The vulnerability in pjsip pjproject (<= 2.16) involves a heap-based buffer overflow in the Opus codec decode path. The FEC decode buffers are allocated using a formula derived from PCM parameters, resulting in a buffer size (e.g., 960 bytes at 8 kHz mono) smaller than the maximum encoded frame size (1280 bytes). The codec_decode() function performs three pj_memcpy() calls copying input->size bytes without bounds checking, which can overflow the allocated buffer. This is classified as CWE-122 (Heap-based Buffer Overflow).

Successful exploitation of this vulnerability could lead to memory corruption due to heap overflow, potentially causing application crashes or enabling an attacker to execute arbitrary code with the privileges of the affected application. The CVSS 4.0 vector indicates local attack vector with low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding use of affected versions (<= 2.16) or applying any available workarounds from the vendor. Monitor official pjsip channels for updates.