The opus_packet_get_samples_per_frame function in client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots allows remote attackers to cause a denial of service (crash) via a crafted length prefix value, which triggers a NULL pointer dereference or a heap-based buffer over-read (aka "out-of-bounds array access").
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade mumble | Jul 30, 2024 | Feb 8, 2014 |
| Freebsd | — | Upgrade mumble | Dec 10, 2025 | May 29, 2014 |
| Gentoo Linux | — | Upgrade media-sound/mumble. | Oct 30, 2017 | Feb 7, 2014 |
| Suse | — | Upgrade mumble-server-debuginfoUpgrade mumbleUpgrade mumble-32bitUpgrade mumble-debugsourceUpgrade mumble-debuginfo-32bitUpgrade mumble-debuginfoUpgrade mumble-server | Dec 18, 2015 | Feb 7, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub