CVE-2026-57166

PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps.

PJSIP prior to commit c4a151a has a stack buffer overflow in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate. An incorrect buffer-size value can cause an oversized entry to be written past the end of a fixed-size stack buffer.

PJSIP prior to commit a1b707c has a stack buffer overflow in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer. An excessive number of attributes can cause a write past the end of a fixed-size array on the stack.

PJSIP before version 2.17 has a heap out-of-bounds read vulnerability in the VP9 RTP unpacketizer. Insufficient bounds checking on payload descriptor length may cause reads beyond the allocated RTP buffer.

PJSIP is a free and open source multimedia communication library that may incorrectly switch from using SRTP media transport to basic RTP upon SRTP restart. This leads to media being sent insecurely.

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the OpenSSL and GnuTLS backends copy DNS SubjectAltName values with string functions that recalculate their length and truncate an embedded NUL byte. With server verification enabled through --tls-verify-server, a certificate containing a DNS SubjectAltName formed from the target hostname prefix followed by an embedded NUL and an attacker-controlled suffix can be accepted for the prefix hostname.

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/avi_player.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media dimensions. A crafted AVI file can therefore cause an attacker-controlled out-of-bounds write past the heap allocation when an application plays the file or pulls its frames. The existing size assertion does not protect production release builds, where assertions are disabled. Typical local playback can crash the process, while applications that accept untrusted AVI sources expose a stronger memory-corruption condition. No fixed version is available as of this review.

In the PJSIP library before commit 628b716, there is a stack buffer overflow in the telnet CLI front-end (handle_up_down() in cli_telnet.c) when redrawing the command line during history recall. This affects only applications with the telnet CLI enabled and may lead to application termination. Exploitation requires access to the unauthenticated telnet CLI, which already permits arbitrary CLI commands, so the additional impact is limited.

PJSIP prior to commit 8d5956a has a heap buffer overflow in the PJLIB-UTIL HTTP client when buffering an HTTP response body. An incorrect size calculation based on Content-Length can cause data to be written past the end of the buffer.

PJSIP prior to commit acc03b5 has a stack buffer overflow in PJSUA when processing Service-Route headers in a registration response. An excessive number of headers can cause a write past the end of a fixed-size array on the stack.