CVE-2023-27585 identifies a heap-based buffer overflow vulnerability in the open-source multimedia communication library PJSIP, specifically in the pjproject component versions 2.13 and earlier. The vulnerability arises in the DNS resolver module during the parsing of DNS query records within the parse_query() function. This flaw is related to a previous vulnerability (CVE-2022-24793) but differs in the parsing function affected. The buffer overflow can be triggered remotely without authentication or user interaction, as it involves processing DNS responses. Successful exploitation can cause application crashes, resulting in denial of service (DoS). The vulnerability does not compromise confidentiality or integrity but impacts availability. A patch has been committed to the master branch of the pjproject repository (commit d1c5e4d). As a workaround, disabling the internal DNS resolver by setting the nameserver_count to zero or using an external DNS resolver implementation can mitigate the risk. No public exploits have been reported, but the high CVSS score (7.5) reflects the ease of remote exploitation and the potential for service disruption. This vulnerability is critical for applications relying on PJSIP's DNS resolver, commonly used in VoIP and multimedia communication systems.

For European organizations, the primary impact of CVE-2023-27585 is the potential denial of service in communication systems that utilize PJSIP's DNS resolver. This can disrupt VoIP services, unified communications, and other multimedia applications dependent on pjproject, leading to operational downtime and degraded service quality. Telecommunications providers, enterprises with internal VoIP infrastructure, and service providers using PJSIP-based solutions are particularly vulnerable. Disruptions in communication services can affect business continuity, customer support, and critical communications, especially in sectors like finance, healthcare, and government. Although the vulnerability does not allow data leakage or code execution, the availability impact can have cascading effects on dependent services and user trust. The lack of known exploits reduces immediate risk, but the ease of exploitation and network exposure necessitate prompt remediation.

Organizations should immediately update pjproject to the latest patched version containing commit d1c5e4d to address the vulnerability. If patching is not immediately feasible, configure PJSIP to disable its internal DNS resolver by setting the nameserver_count parameter to zero, forcing the use of an external, secure DNS resolver implementation. Network-level protections such as firewall rules to restrict DNS traffic to trusted resolvers can reduce exposure. Monitoring and logging DNS resolver activity within PJSIP-enabled applications can help detect anomalous behavior. Additionally, organizations should review their VoIP and multimedia communication architectures to identify and isolate vulnerable components. Regular vulnerability scanning and integration of PJSIP updates into patch management workflows will prevent recurrence. Finally, educating developers and system administrators about secure configuration of PJSIP components will enhance long-term security posture.