CVE-2025-71264: 
NixOS vulnerability analysis and mitigation

CVE-2025-71264 is an out-of-bounds array access vulnerability in the Mumble VoIP client's Opus audio decoder that can result in denial of service via client crash. It affects all Mumble versions before 1.6.870 and was disclosed on March 16, 2026. The root cause lies in incorrect buffer size calculations and per-channel frame size handling in AudioOutputSpeech.cpp. It carries a CVSS v3.1 base score of 5.3 (Medium) per NVD, though ENISA's EUVD rates it 3.7 (Low) under a higher-complexity vector (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and stems from two related bugs in src/mumble/AudioOutputSpeech.cpp. First, the audio buffer (iAudioBufferSize) was sized for only 60ms of Opus audio data, whereas the Opus specification (RFC 7587 §4.2) allows packets containing multiple frames up to 120ms total duration — causing potential buffer overflows when decoding multi-frame packets. Second, calls to opus_decode_float incorrectly passed the total frame size instead of the per-channel frame size; for stereo streams, this caused the Opus decoder to assume the buffer was twice its actual size, enabling out-of-bounds array access. A remote attacker can trigger this by sending crafted audio packets to a connected Mumble client without authentication or user interaction (GitHub PR #7032, GitHub Commit).

Successful exploitation results in a denial of service through a crash of the Mumble client application. An unauthenticated remote attacker on the same Mumble server can send malicious audio packets to cause connected clients to crash, disrupting VoIP communications. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability of the client application (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.037%, reflecting a very low probability of exploitation in the near term. No threat actor attribution has been reported (Red Hat Advisory).

1. Reconnaissance: Identify a target Mumble server with connected clients running Mumble versions prior to 1.6.870, particularly those using stereo audio output.
2. Connect to the server: Join the same Mumble server as the target client(s) — no special privileges are required beyond standard server access.
3. Craft malicious audio packet: Prepare an Opus audio packet that either (a) contains multiple frames bundled to exceed 60ms (up to 120ms) to overflow the undersized audio buffer, or (b) is encoded as stereo audio to trigger the incorrect per-channel frame size calculation in opus_decode_float.
4. Transmit the packet: Transmit the crafted audio packet over the network to the target Mumble client. The client's AudioOutputSpeech::prepareSampleBuffer function will process the packet and trigger the out-of-bounds array access.
5. Achieve denial of service: The out-of-bounds memory access causes the Mumble client to crash, denying the victim use of the VoIP application (GitHub PR #7032, GitHub Commit).

• Process: Unexpected crashes of the Mumble client process (mumble or mumble.exe), particularly when receiving audio from a specific user or server.
• Logs: Crash reports or core dumps from the Mumble client referencing AudioOutputSpeech::prepareSampleBuffer or opus_decode_float in the stack trace.
• Network: Unusual or malformed Opus audio packets received from a peer on the Mumble server, especially packets with durations exceeding 60ms or stereo-encoded streams from unexpected sources.

Users should upgrade Mumble to version 1.6.870 or later, which contains the fix introduced in commit ff2a2332 via pull request #7032. The patch corrects the iAudioBufferSize calculation to accommodate 120ms Opus packets and fixes opus_decode_float calls to pass per-channel frame sizes. No configuration-based workaround is available; upgrading is the only remediation. OpenSUSE has also issued a security update for affected packages (GitHub Commit, GitHub PR #7032, Red Hat Advisory).

Red Hat tracked the issue at low severity in their Bugzilla system, and OpenSUSE issued a security announcement for affected packages. Tenable added detection for this vulnerability via Nessus plugin 302507. Community discussion was limited, with automated CVE tracking accounts on Bluesky and Nitter noting the disclosure shortly after publication. No significant researcher commentary or media coverage beyond routine vulnerability tracking has been observed.