CVE-2026-57160: CWE-193: Off-by-one Error in pjsip pjproject

PJSIP is an open source multimedia communication library written in C. Prior to commit d6a0e7f, the function pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c could write one byte beyond the allocated buffer when serializing generic array headers such as Allow, Require, Supported, and Unsupported. This off-by-one error is reachable primarily in applications like proxies, SBCs, or B2BUAs that handle incoming SIP requests and re-serialize them, where a remote peer can influence the serialized message. The out-of-bounds write is limited to a single byte and does not demonstrate code execution or information disclosure. Typically, the extra byte falls within allocation slack in pool-based memory allocations. The issue was fixed in commit d6a0e7f.

The vulnerability allows a single byte to be written out-of-bounds in the output buffer during SIP message serialization. Although code execution and information disclosure have not been demonstrated, the flaw could potentially lead to memory corruption in affected applications that parse and re-serialize SIP requests. The impact is considered medium severity based on the CVSS score of 6.9.

An official fix is available and was applied in commit d6a0e7f. Users and maintainers of pjsip pjproject should update to the patched version containing this commit to remediate the vulnerability. No additional mitigation steps are indicated.