The vulnerability in pjsip pjproject (<= 2.16) arises from a heap-based buffer overflow in the Opus codec decode path. The FEC decode buffers (dec_frame[].buf) are allocated using a formula derived from PCM parameters, resulting in insufficient buffer size (e.g., 960 bytes at 8 kHz mono). However, the codec_parse() function can output encoded frames up to 1280 bytes via opus_repacketizer_out_range(). The pj_memcpy() calls in codec_decode() copy input->size bytes without verifying buffer boundaries, causing a heap overflow. This is classified as CWE-122.

Successful exploitation of this vulnerability could lead to memory corruption due to heap buffer overflow when decoding specially crafted Opus audio frames. This may result in application crashes or potentially allow execution of arbitrary code. The CVSS 4.0 score of 8.5 indicates high severity, with local attack vector, low attack complexity, no privileges required, and user interaction needed. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding use of vulnerable pjproject versions with untrusted Opus audio input. Monitoring vendor channels for updates is recommended.