CVE-2026-71980: Belledonnecommunications BCG729

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe() function in src/cng.c that allows unauthenticated network-adjacent attackers to trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. A zero-length payload causes an integer underflow in the uint8_t filter order calculation, which wraps to 255 and is clamped to 10, causing the function to unconditionally read 11 bytes from a zero-byte buffer, resulting in media process termination or silent consumption of adjacent heap memory as reflection coefficients.

Affected products

• Belledonnecommunications BCG729: up to and including 1.1.2

Published 2026-08-17. Last modified 2026-09-24.