CVE-2025-0430 Belledonne Communications CVE debrief

Who should care

Organizations using Linphone-Desktop 5.2.6 for VoIP communications, particularly in operational technology (OT) environments where CISA advisories are relevant. System administrators managing softphone deployments, security teams monitoring VoIP infrastructure for availability risks, and users relying on Linphone for critical communications should prioritize patching.

Technical summary

The vulnerability exists in the linphone-sdk component used by Linphone-Desktop 5.2.6. A NULL pointer dereference occurs when processing network input, allowing a remote attacker to crash the application without authentication. The CVSS 3.1 score of 7.5 reflects the high availability impact combined with the low attack complexity and lack of required privileges or user interaction. The attack surface is the network interface handling SIP/VoIP communications. Successful exploitation results in application termination, disrupting voice and video communications for affected users.

Defensive priority

HIGH

Recommended defensive actions

• Upgrade to linphone-sdk version 5.3.99 or later to obtain the vendor fix
• If immediate patching is not feasible, restrict network access to Linphone-Desktop instances to trusted sources only
• Monitor for abnormal application crashes or unexpected termination of Linphone-Desktop processes
• Review CISA's ICS recommended practices for additional defense-in-depth strategies
• Apply principle of least privilege for VoIP/SIP communications infrastructure

Evidence notes

The vulnerability is specifically identified as a NULL Dereference in Linphone-Desktop version 5.2.6. CISA's CSAF data confirms the affected product and vendor attribution with high confidence. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates network accessibility with low attack complexity, no required privileges or user interaction, and high impact to availability only.

Official resources