HP Poly VoIP vulnerability sets the stage for executive voice deepfakes

HP released patches for a critical buffer overflow vulnerability (a coding flaw where too much data is written into a fixed-size memory container) in its Poly Voice conference phones that could allow attackers without authentication to gain root access (complete control of the operating system) and record conversations for voice deepfakes (AI-generated fake audio impersonations). The flaw exists in code that processes ICE (Interactive Connectivity Establishment, a feature for establishing direct network connections) requests and affects multiple Poly phone models.