CVE-2026-57163: CWE-121: Stack-based Buffer Overflow in pjsip pjproject

PJSIP's pjproject library, when built with the GnuTLS TLS backend, contains a stack buffer overflow vulnerability in the function tls_cert_get_info() within ssl_sock_gtls.c. This occurs during parsing of the Subject Alternative Name extension in a peer certificate after the TLS handshake. An incorrect buffer-size value can cause an oversized SubjectAltName entry to overwrite a fixed-size stack buffer. This vulnerability can be triggered by a network-positioned attacker presenting a malicious certificate, either as a server to a client or as a client to a server requesting certificates. The impact ranges from application termination to potential control flow hijacking or memory corruption. The vulnerability was fixed in commit c4a151a.

Exploitation of this vulnerability can lead to unexpected application termination or memory corruption, potentially allowing an attacker to hijack control flow. The attack can be performed remotely during the TLS handshake phase without requiring prior authentication. Only builds using the GnuTLS backend are affected; OpenSSL and Apple SecureTransport/Network.framework builds are not vulnerable.

This vulnerability has been patched by the pjproject maintainers via commit c4a151a. Users should update to the fixed version that includes this commit. If updating is not immediately possible, avoid using the GnuTLS backend (--with-gnutls) for TLS in pjproject. No other mitigations are specified.