CVE-2026-57159: CWE-129: Improper Validation of Array Index in pjsip pjproject
Description
CVE-2026-57159 is a high-severity vulnerability in the pjsip pjproject multimedia communication library. It involves improper validation of array indexes in the SDP negotiator component when the remote payload-type map maintenance feature (PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP) is enabled. This flaw allows a crafted remote SDP offer or answer to cause out-of-bounds memory access, leading to memory corruption and denial of service. The vulnerability does not affect default builds where this feature is disabled. A patch addressing this issue has been committed.
CVSS v4.0
Score 8.4high
Affected software
pjsip
pjproject
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in pjsip pjproject arises from the function assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c, which uses payload-type numbers from remote SDP offers or answers to index fixed-size internal tables without adequate bounds checking. When the PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP feature is enabled, a remote attacker can send a specially crafted SDP message that triggers out-of-bounds read and write operations, causing memory corruption and potential denial of service. The issue was fixed in commit 673b978. Default builds are not affected as the feature is disabled by default.
Potential Impact
Successful exploitation can cause memory corruption and denial of service in affected applications using pjsip pjproject with the remote payload-type map maintenance feature enabled. There is no evidence of code execution exploitation. Default configurations are not vulnerable since the feature is disabled by default.
Mitigation Recommendations
A patch fixing this vulnerability has been committed (commit 673b978). Users should apply this official fix if they enable the PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP feature. Default builds with this feature disabled are not affected and require no action.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-24T01:45:48.698Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9afe70acd9273b49f0e668
Added to database: 09/04/2026, 17:22:56 UTC
Last enriched: 10/18/2026, 00:35:27 UTC
Last updated: 10/18/2026, 18:48:22 UTC
Views: 77
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.