PJSIP pjproject versions prior to 2.17 contain an integer overflow vulnerability (CWE-190) in the calculation of media stream buffer sizes when handling SDP data with asymmetric ptime settings. This overflow can cause the buffer to be allocated with insufficient size, resulting in memory corruption or application crashes. The vulnerability is remotely exploitable without authentication and requires no user interaction. It was publicly disclosed with a CVSS 4.0 base score of 8.1, indicating high severity. The issue is resolved in pjproject version 2.17.

Exploitation of this vulnerability may cause the affected application to terminate unexpectedly or suffer memory corruption, which could potentially be leveraged to disrupt service or cause denial of service conditions. No known exploits are reported in the wild at this time.

Upgrade to pjproject version 2.17 or later, where this integer overflow vulnerability is fixed. Patch status is confirmed by the vendor's versioning information. No other mitigations are indicated.