High severity · published Nov 21, 2025
CVE-2025-65102
PJSIP is vulnerable to buffer overflow in Opus PLC
8.7
CVSS
0.3%
EPSS
No
On KEV
Description
PJSIP is a free and open source multimedia communication library. Prior to version 2.16, Opus PLC may zero-fill the input frame as long as the decoder ptime, while the input frame length, which is based on stream ptime, may be less than that. This issue affects PJSIP users who use the Opus audio codec in receiving direction. The vulnerability can lead to unexpected application termination due to a memory overwrite. This issue has been patched in version 2.16.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PJ
pjproject · pjsip
< 2.16 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-65102
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-65102
github.com
https://github.com/pjsip/pjproject/commit/6e9bd2e7d25bba26f852771b40693f45da14fa8f
github.com
https://github.com/pjsip/pjproject/security/advisories/GHSA-w5vr-39x7-h8g5
More from pjproject
9.8
CVE-2026-40892
PJSIP: Stack buffer overflow in pjsip_auth_create_digest2()
9.8
CVE-2026-32945
PJSIP is vulnerable to Heap-based Buffer Overflow through DNS parser
9.8
CVE-2026-25994
PJSIP has a heap buffer overflow in ICE with long username
9.8
CVE-2022-39244
Buffer overflow in pjlib scanner and pjmedia
9.1
CVE-2026-57163
PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend