How severe is CVE-2014-1916?

CVE-2014-1916 has a CVSS 2.0 base score of 5.0, rated medium severity.

Is CVE-2014-1916 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (75th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2014-1916?

CVE-2014-1916 primarily affects Light Speed Gaming Mumble. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2014-1916?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2014-1916 published?

CVE-2014-1916 was published on 2014-02-08 and last updated on 2026-06-17.

CVE-2014-1916

CVE-2014-1916 is a medium-severity vulnerability in Light Speed Gaming Mumble with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-399.

Key facts

Severity: Medium (CVSS 2.0 base score 5.0)
EPSS exploit prediction: 2% (75th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-399
Affected product: Light Speed Gaming Mumble
Published: 2014-02-08
Last modified: 2026-06-17

Description

The (1) opus_packet_get_nb_frames and (2) opus_packet_get_samples_per_frame functions in the client in MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d and Mumble for iOS 1.1 through 1.2.2 do not properly check the return value of the copyDataBlock method, which allow remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted length prefix value in an Opus voice packet.

Frequently asked questions

What is CVE-2014-1916?: The (1) opus_packet_get_nb_frames and (2) opus_packet_get_samples_per_frame functions in the client in MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d and Mumble for iOS 1.1 through 1.2.2 do not properly check the return value of the copyDataBlock method, which allow remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted length prefix value in an Opus voice packet.
How severe is CVE-2014-1916?: CVE-2014-1916 has a CVSS 2.0 base score of 5.0, rated medium severity.
Is CVE-2014-1916 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (75th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2014-1916?: CVE-2014-1916 primarily affects Light Speed Gaming Mumble. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2014-1916?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2014-1916 published?: CVE-2014-1916 was published on 2014-02-08 and last updated on 2026-06-17.

References

Affected products (7)

cpe:2.3:a:light_speed_gaming:mumble:1.1:*:*:*:*:iphone_os:*:*
cpe:2.3:a:light_speed_gaming:mumble:1.1:rc1:*:*:*:iphone_os:*:*
cpe:2.3:a:light_speed_gaming:mumble:1.1.1:*:*:*:*:iphone_os:*:*
cpe:2.3:a:light_speed_gaming:mumble:1.2:*:*:*:*:iphone_os:*:*
cpe:2.3:a:light_speed_gaming:mumble:1.2.1:*:*:*:*:iphone_os:*:*
cpe:2.3:a:light_speed_gaming:mumble:1.2.2:*:*:*:*:iphone_os:*:*
cpe:2.3:a:light_speed_gaming:mumblekit:-:*:*:*:*:*:*:*

More vulnerabilities in Light Speed Gaming Mumble

CVE-2014-0045 — High (CVSS 7.5): The needSamples method in AudioOutputSpeech.cpp in the client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots,…
CVE-2014-0044 — Medium (CVSS 5.0): The opus_packet_get_samples_per_frame function in client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots allows…

All CVEs affecting Light Speed Gaming Mumble →

Other CWE-399 (Resource Management Errors) vulnerabilities

CVE-2015-8104 — Critical (CVSS 10.0): The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a…
CVE-2015-0339 — Critical (CVSS 10.0): Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before…
CVE-2015-0335 — Critical (CVSS 10.0): Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before…
CVE-2015-0333 — Critical (CVSS 10.0): Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before…
CVE-2014-4121 — Critical (CVSS 10.0): Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly parse internationalized…
CVE-2014-0560 — Critical (CVSS 10.0): Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS…

Browse all CWE-399 (Resource Management Errors) vulnerabilities →