CVE-2026-57160
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
In the PJSIP library before commit d6a0e7f, there is a buffer overflow in pjsip_generic_array_hdr_print() in sip_msg.c, which serializes generic array headers (e.g., Allow, Require, Supported). Under certain output-buffer boundary conditions, the function can write one byte past the end of the buffer. This is reachable mainly in applications that parse and re-serialize incoming SIP requests, such as proxies, SBCs, or B2BUAs.
Risk Assessment
The risk is low because the out-of-bounds write is a single fixed byte, and code execution or information disclosure is not demonstrated. In typical pool-based allocations, the byte falls within allocation slack.
Recommendation
Upgrade PJSIP to a version containing commit d6a0e7f. Also monitor SIP-processing applications for unusual behavior.
Other vulnerabilities in PJSIP
See all- CVE-2022-24763High
PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps.
- CVE-2026-34235Critical
PJSIP before version 2.17 has a heap out-of-bounds read vulnerability in the VP9 RTP unpacketizer. Insufficient bounds checking on payload descriptor length may cause reads beyond the allocated RTP buffer.
- CVE-2022-39269Critical
PJSIP is a free and open source multimedia communication library that may incorrectly switch from using SRTP media transport to basic RTP upon SRTP restart. This leads to media being sent insecurely.
- CVE-2026-57165Medium
In the PJSIP library before commit 628b716, there is a stack buffer overflow in the telnet CLI front-end (handle_up_down() in cli_telnet.c) when redrawing the command line during history recall. This affects only applications with the telnet CLI enabled and may lead to application termination. Exploitation requires access to the unauthenticated telnet CLI, which already permits arbitrary CLI commands, so the additional impact is limited.
- CVE-2026-57164High
PJSIP prior to commit 8d5956a has a heap buffer overflow in the PJLIB-UTIL HTTP client when buffering an HTTP response body. An incorrect size calculation based on Content-Length can cause data to be written past the end of the buffer.
- CVE-2026-57163High
PJSIP prior to commit c4a151a has a stack buffer overflow in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate. An incorrect buffer-size value can cause an oversized entry to be written past the end of a fixed-size stack buffer.
- CVE-2026-57162High
PJSIP prior to commit a1b707c has a stack buffer overflow in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer. An excessive number of attributes can cause a write past the end of a fixed-size array on the stack.
- CVE-2026-57161High
PJSIP prior to commit acc03b5 has a stack buffer overflow in PJSUA when processing Service-Route headers in a registration response. An excessive number of headers can cause a write past the end of a fixed-size array on the stack.
- CVE-2026-57159High
PJSIP prior to commit 673b978 has a remote out-of-bounds read and write in the SDP negotiator when the remote payload-type map maintenance feature is enabled. Insufficient bounds validation can cause memory access outside fixed-size tables.
Original NVD description (English source)
PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c, the function that serializes generic array headers (such as Allow, Require, Supported, and Unsupported). Under certain output-buffer boundary conditions the function can write one byte past the end of the buffer. This is reachable mainly in applications that parse and re-serialize incoming SIP requests — for example a proxy, SBC, or B2BUA — where a remote peer can influence the serialized message. The out-of-bounds write is a single fixed byte; code execution and information disclosure are not demonstrated, and in typical pool-based allocations the byte falls within allocation slack. This issue has been patched via commit d6a0e7f.