The vulnerability CVE-2026-41415 affects pjsip's pjproject library versions prior to 2.17. It involves an out-of-bounds read triggered by parsing a malformed Content-ID URI in SIP multipart message bodies. The root cause is insufficient length validation, which can cause the software to read beyond the intended buffer limits. This flaw is categorized under CWE-125 (Out-of-bounds Read). The vulnerability has a CVSS 4.0 base score of 6.7, indicating a medium severity level. The vendor has fixed this issue in pjproject version 2.17.

Successful exploitation of this vulnerability can lead to out-of-bounds reads, which may cause application crashes or potentially expose sensitive memory contents. The CVSS vector indicates the vulnerability is remotely exploitable without privileges or user interaction, with a high impact on availability and limited impact on integrity. No known exploits are reported in the wild at this time.

Upgrade pjproject to version 2.17 or later, where this vulnerability is fixed. Since the vendor has released an official fix, applying this update is the recommended remediation. There is no indication that temporary workarounds or mitigations are available or required beyond patching.