The vulnerability CVE-2026-42225 affects the pjsip pjproject multimedia communication library written in C. Specifically, in versions before 2.17 on GnuTLS builds, the SIP TLS transport (sip_transport_tls) improperly validates certificates, allowing acceptance of invalid or untrusted certificates despite explicit verification settings (verify_server = PJ_TRUE or verify_client = PJ_TRUE). This flaw is categorized under CWE-295 (Improper Certificate Validation). The issue was addressed and fixed in pjproject version 2.17.

This vulnerability allows an attacker to bypass TLS certificate validation in the SIP TLS transport, potentially enabling man-in-the-middle attacks or unauthorized connections by presenting invalid or untrusted certificates. This undermines the security guarantees of TLS in the affected versions, potentially exposing sensitive communication to interception or tampering. However, no known exploits have been reported in the wild to date.

Upgrade to pjproject version 2.17 or later, where this certificate validation issue has been fixed. Since the vulnerability is patched in version 2.17, applying this official fix is the recommended remediation. Patch status is confirmed by the vendor advisory indicating the fix in version 2.17.