CVE-2026-57161: CWE-121: Stack-based Buffer Overflow in pjsip pjproject

PJSIP's pjproject contains a stack buffer overflow vulnerability in the update_service_route() function within pjsua_acc.c. When processing Service-Route headers from a 2xx REGISTER response, the code stores these URIs into a fixed-size stack array without limiting the number of headers. A malicious or compromised registrar can send an excessive number of Service-Route headers, causing writes beyond the array boundary. The overflow writes internal pointers rather than arbitrary data, making denial of service via application termination the most likely impact, though memory corruption cannot be ruled out. The vulnerability affects the default registration path using the PJSUA/PJSUA2 account API and was fixed by commit acc03b5.

Exploitation can cause unexpected application termination (denial of service) due to stack buffer overflow. Memory corruption is also possible but less certain. The malicious input could come from a compromised or malicious registrar or a spoofed response over unprotected transports. No known exploits are reported in the wild.

This vulnerability has been patched by commit acc03b5. Users should update to the fixed version containing this commit. No other mitigation actions are specified.