« Back to list

CVE-2025-49140

Status: DeferredHigh (7.5)—

Pion Interceptor is a framework for building RTP/RTCP communication software. Versions v0.1.36 through v0.1.38 contain a bug in a RTP packet factory that can be exploited to trigger a panic with Pion based SFU via crafted RTP packets, This only affect users that use pion/interceptor. Users should upgrade to v0.1.39 or later, which validates that: `padLen > 0 && padLen <= payloadLength` and return error on overflow, avoiding panic. If upgrading is not possible, apply the patch from the pull request manually or drop packets whose P-bit is set but whose padLen is zero or larger than the remaining payload.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vulnerabilidad de denegación de servicio en framework RTP expuesto en red (CVSS AV:N), exploitable sin autenticación mediante paquetes RTP malformados que provocan panic, causando indisponibilidad del servicio SFU.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Pion — InterceptorAI

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2025-49140",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-49140",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-10T20:04:30.298657Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "pion",
          "product": "interceptor",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.1.36, < 0.1.39"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-06-09T22:15:22.153",
  "references": [
    {
      "url": "https://github.com/pion/interceptor/commit/fa5b35ea867389cec33a9c82fffbd459ca8958e5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pion/interceptor/pull/338",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pion/interceptor/security/advisories/GHSA-f26w-gh5m-qq77",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pion/webrtc/issues/3148",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pion Interceptor is a framework for building RTP/RTCP communication software. Versions v0.1.36 through v0.1.38 contain a bug in a RTP packet factory that can be exploited to trigger a panic with Pion based SFU via crafted RTP packets, This only affect users that use pion/interceptor. Users should upgrade to v0.1.39 or later, which validates that: `padLen > 0 && padLen <= payloadLength` and return error  on overflow, avoiding panic. If upgrading is not possible, apply the patch from the pull request manually or drop packets whose P-bit is set but whose padLen is zero or larger than the remaining payload."
    },
    {
      "lang": "es",
      "value": "Pion Interceptor es un framework para crear software de comunicación RTP/RTCP. Las versiones v0.1.36 a v0.1.38 contienen un error en una fábrica de paquetes RTP que puede explotarse para generar un pánico con SFU basado en Pion mediante paquetes RTP manipulados. Esto solo afecta a los usuarios que usan pion/interceptor. Los usuarios deben actualizar a la versión v0.1.39 o posterior, que valida que `padLen &gt; 0 &amp;&amp; padLen &lt;= payloadLength` y devuelve un error en caso de desbordamiento, evitando así el pánico. Si no es posible actualizar, aplique el parche desde la solicitud de extracción manualmente o descarte los paquetes cuyo bit P esté configurado, pero cuyo padLen sea cero o mayor que la carga útil restante."
    }
  ],
  "lastModified": "2026-06-17T09:30:48.900",
  "sourceIdentifier": "security-advisories@github.com"
}