PJSIP pjproject versions 2.17 and earlier have an improper certificate validation vulnerability in the OpenSSL and GnuTLS backends. The flaw involves incorrect handling of DNS SubjectAltName values containing embedded NUL bytes, allowing an attacker with a specially crafted certificate from a trusted issuer to impersonate a target server during TLS verification. This can lead to interception of SIP sessions and theft of REGISTER credentials. The mbedTLS backend is not affected. No fixed version is currently available.
PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/avi_player.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media dimensions. A crafted AVI file can therefore cause an attacker-controlled out-of-bounds write past the heap allocation when an application plays the file or pulls its frames. The existing size assertion does not protect production release builds, where assertions are disabled. Typical local playback can crash the process, while applications that accept untrusted AVI sources expose a stronger memory-corruption condition. No fixed version is available as of this review.
A stack-based buffer overflow vulnerability exists in the PJLIB-UTIL telnet CLI front-end of the PJSIP pjproject library prior to commit 4472a31. This occurs when rendering feedback for an entered command line, where insufficient bounds checking allows a long command line to overflow fixed-size buffers. The vulnerability affects only applications that enable the telnet CLI front-end, which is an unauthenticated interactive administration interface. Exploitation requires access to this CLI, limiting impact beyond existing access. The issue has been patched in commit 4472a31.
A stack-based buffer overflow vulnerability (CWE-121) exists in the PJLIB-UTIL telnet CLI front-end of the pjsip pjproject prior to commit 628b716. The flaw occurs during command line redraw when recalling history entries, potentially causing application termination. Exploitation requires access to the unauthenticated telnet CLI, which already allows arbitrary CLI commands, limiting additional impact. Applications not enabling the telnet CLI front-end are unaffected. This issue has been patched.
A heap-based buffer overflow vulnerability exists in the PJLIB-UTIL HTTP client component of pjsip pjproject prior to commit 8d5956a. The flaw occurs when buffering an entire HTTP response body at once, due to incorrect size calculation based on the Content-Length header, potentially allowing memory corruption or application crashes. Applications that process response data incrementally or connect only to trusted servers are not affected. This issue has been patched in commit 8d5956a.
A stack-based buffer overflow vulnerability exists in the GnuTLS TLS backend of the PJSIP pjproject library when parsing the Subject Alternative Name extension of a peer certificate. This affects only builds using GnuTLS (--with-gnutls). An attacker presenting a crafted certificate during the TLS handshake can trigger this overflow, potentially causing application crashes or memory corruption. The issue has been patched.
A stack-based buffer overflow vulnerability exists in the pjsip pjproject multimedia communication library in the SRTP/SDES media transport during SDP offer/answer processing. This occurs when handling an excessive number of a=crypto attributes in a single media description, leading to a write beyond a fixed-size stack array. The flaw is reachable from an incoming SIP INVITE before authentication and affects applications with SRTP enabled using SDES keying. The vulnerability has been patched.
A stack-based buffer overflow vulnerability exists in PJSIP's pjproject prior to commit acc03b5. The flaw occurs when processing Service-Route headers in a registration response, where an excessive number of headers can overflow a fixed-size stack array. This can lead to application crashes or memory corruption. The issue affects applications using the default registration path via the PJSUA/PJSUA2 account API. The vulnerability has been patched in commit acc03b5.
CVE-2026-57160 is an off-by-one buffer overflow vulnerability in the pjsip_generic_array_hdr_print() function of the pjsip pjproject library. This function serializes generic array headers in SIP messages. The flaw allows writing one byte past the end of the output buffer under certain boundary conditions, mainly affecting applications that parse and re-serialize SIP requests. The vulnerability has been patched.
CVE-2026-57159 is a high-severity vulnerability in the pjsip pjproject multimedia communication library. It involves improper validation of array indexes in the SDP negotiator component when the remote payload-type map maintenance feature (PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP) is enabled. This flaw allows a crafted remote SDP offer or answer to cause out-of-bounds memory access, leading to memory corruption and denial of service. The vulnerability does not affect default builds where this feature is disabled. A patch addressing this issue has been committed.
CVE-2026-42225 is a high-severity vulnerability in the pjsip pjproject library prior to version 2.17. On GnuTLS builds, the SIP TLS transport component can accept connections with invalid or untrusted certificates even when certificate verification is explicitly enabled. This improper certificate validation issue is identified as CWE-295. The vulnerability has been patched in version 2.17. No known exploits in the wild have been reported.
PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an integer overflow in media stream buffer size calculation when processing SDP with asymmetric ptime configuration. The overflow may result in an undersized buffer allocation, which can lead to unexpected application termination or memory corruption This vulnerability is fixed in 2.17.
CVE-2026-41415 is an out-of-bounds read vulnerability in the pjsip pjproject library versions 2.16 and earlier. It occurs when parsing a malformed Content-ID URI in a SIP multipart message body due to insufficient length validation, allowing reads beyond buffer boundaries. This vulnerability has a medium severity with a CVSS score of 6.7. The issue is fixed in version 2.17 of pjproject.
PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsip_auth_create_digest2() in PJSIP when using pre-computed digest credentials (PJSIP_CRED_DATA_DIGEST). The function copies credential data using cred_info->data.slen as the length without an upper-bound check, which can overflow the fixed-size ha1 stack buffer (128 bytes) if data.slen exceeds the expected digest string length.
CVE-2026-40614 is a heap-based buffer overflow vulnerability in the pjsip pjproject library versions 2.16 and earlier. It arises from insufficient buffer size validation when decoding Opus audio frames, where the allocated buffer is smaller than the maximum possible encoded frame size. This causes unsafe memory copying operations leading to a heap overflow. The vulnerability has a high severity with a CVSS score of 8.5. No official patch or remediation guidance is currently available from the vendor.
PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap out-of-bounds read vulnerability exists in PJSIP's VP9 RTP unpacketizer that occurs when parsing crafted VP9 Scalability Structure (SS) data. Insufficient bounds checking on the payload descriptor length may cause reads beyond the allocated RTP payload buffer. This issue has been patched in version 2.17. A workaround for this issue involves disabling VP9 codec if not needed.
PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a cascading out-of-bounds heap read in pjsip_multipart_parse(). After boundary string matching, curptr is advanced past the delimiter without verifying it has not reached the buffer end. This allows 1-2 bytes of adjacent heap memory to be read. All applications that process incoming SIP messages with multipart bodies or SDP content are potentially affected. This issue is resolved in version 2.17.
PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a Heap-based Buffer Overflowvulnerability in the DNS parser's name length handler. Thisimpacts applications using PJSIP's built-in DNS resolver, such as those configured with pjsua_config.nameserver or UaConfig.nameserver in PJSUA/PJSUA2. It does not affect users who rely on the OS resolver (e.g., getaddrinfo()) by not configuring a nameserver, or those using an external resolver via pjsip_resolver_set_ext_resolver(). This issue is fixed in version 2.17. For users unable to upgrade, a workaround is to disable DNS resolution in the PJSIP config (by setting nameserver_count to zero) or to use an external resolver implementation instead.
CVE-2026-32942 is a high-severity use-after-free vulnerability in the pjsip pjproject multimedia communication library, affecting versions prior to 2.17. The flaw arises from race conditions during ICE session destruction and callback execution, leading to heap memory corruption. Exploitation requires no authentication or user interaction and can result in high confidentiality and integrity impacts, such as remote code execution or denial of service. The vulnerability has been fixed in version 2.17. Organizations using vulnerable versions of pjproject in VoIP or multimedia applications should urgently update to mitigate risks. No known exploits are currently reported in the wild. Countries with significant pjproject deployment and strategic VoIP infrastructure are at higher risk.
PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap use-after-free vulnerability exists in PJSIP's event subscription framework (evsub.c) that is triggered during presence unsubscription (SUBSCRIBE with Expires=0). This issue has been patched in version 2.17.