CVE-2026-57163
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
PJSIP prior to commit c4a151a has a stack buffer overflow in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate. An incorrect buffer-size value can cause an oversized entry to be written past the end of a fixed-size stack buffer.
Risk Assessment
A network-positioned attacker can trigger this during the TLS handshake, potentially causing application crashes or control flow hijack.
Recommendation
Upgrade PJSIP to a version containing commit c4a151a, which fixes this vulnerability.
Other vulnerabilities in PJSIP
See all- CVE-2022-24763High
PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps.
- CVE-2026-34235Critical
PJSIP before version 2.17 has a heap out-of-bounds read vulnerability in the VP9 RTP unpacketizer. Insufficient bounds checking on payload descriptor length may cause reads beyond the allocated RTP buffer.
- CVE-2022-39269Critical
PJSIP is a free and open source multimedia communication library that may incorrectly switch from using SRTP media transport to basic RTP upon SRTP restart. This leads to media being sent insecurely.
- CVE-2026-57165Medium
In the PJSIP library before commit 628b716, there is a stack buffer overflow in the telnet CLI front-end (handle_up_down() in cli_telnet.c) when redrawing the command line during history recall. This affects only applications with the telnet CLI enabled and may lead to application termination. Exploitation requires access to the unauthenticated telnet CLI, which already permits arbitrary CLI commands, so the additional impact is limited.
- CVE-2026-57164High
PJSIP prior to commit 8d5956a has a heap buffer overflow in the PJLIB-UTIL HTTP client when buffering an HTTP response body. An incorrect size calculation based on Content-Length can cause data to be written past the end of the buffer.
- CVE-2026-57162High
PJSIP prior to commit a1b707c has a stack buffer overflow in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer. An excessive number of attributes can cause a write past the end of a fixed-size array on the stack.
- CVE-2026-57161High
PJSIP prior to commit acc03b5 has a stack buffer overflow in PJSUA when processing Service-Route headers in a registration response. An excessive number of headers can cause a write past the end of a fixed-size array on the stack.
- CVE-2026-57160Medium
In the PJSIP library before commit d6a0e7f, there is a buffer overflow in pjsip_generic_array_hdr_print() in sip_msg.c, which serializes generic array headers (e.g., Allow, Require, Supported). Under certain output-buffer boundary conditions, the function can write one byte past the end of the buffer. This is reachable mainly in applications that parse and re-serialize incoming SIP requests, such as proxies, SBCs, or B2BUAs.
- CVE-2026-57159High
PJSIP prior to commit 673b978 has a remote out-of-bounds read and write in the SDP negotiator when the remote payload-type map maintenance feature is enabled. Insufficient bounds validation can cause memory access outside fixed-size tables.
Original NVD description (English source)
PJSIP is a free and open source multimedia communication library written in C. Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate (tls_cert_get_info() in ssl_sock_gtls.c). Only GnuTLS builds are affected (--with-gnutls); OpenSSL and Apple SecureTransport/Network.framework builds are not affected. While extracting certificate information after a TLS handshake, an incorrect buffer-size value can cause an oversized SubjectAltName entry to be written past the end of a fixed-size stack buffer. A network-positioned attacker presenting a crafted certificate — a malicious server to a connecting client, or a malicious client to a server that requests certificates — can trigger this during the TLS handshake, before any SIP-level authentication. Impact may range from unexpected application termination to control flow hijack/memory corruption. This issue has been patched via commit c4a151a.