What is the CVSS score of CVE-2026-28799?

CVE-2026-28799 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Pjsip are affected by CVE-2026-28799?

PJSIP versions prior to 2.17 contain a memory vulnerability that could allow attackers to crash or potentially execute code through malicious presence unsubscription requests.. A patch is available.

How to fix or mitigate CVE-2026-28799?

Within 24 hours: Inventory all systems running PJSIP and identify version numbers; assess exposure in production environments. Within 7 days: Develop and test patches in staging environment; establish maintenance window for affected systems. Within 30 days: Deploy patched PJSIP version 2.17 or later to all production systems; verify successful patch application across the environment.

Pjsip CVE-2026-28799

HIGH

Use After Free (CWE-416)

2026-03-06 security-advisories@github.com

Use After Free Pjsip Red Hat

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.5 HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

Patch released

Mar 10, 2026 - 19:44 nvd

Patch available

CVE Published

Mar 06, 2026 - 07:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap use-after-free vulnerability exists in PJSIP's event subscription framework (evsub.c) that is triggered during presence unsubscription (SUBSCRIBE with Expires=0). This issue has been patched in version 2.17.

AnalysisAI

PJSIP versions prior to 2.17 contain a heap use-after-free vulnerability in the event subscription framework that can be triggered through presence unsubscription requests, allowing remote attackers without authentication to cause denial of service. The vulnerability resides in the evsub.c component and is exploitable over the network with no user interaction required. A patch is available in version 2.17 and later.

Technical ContextAI

Classified as CWE-416 (Use After Free). Affects Pjsip. PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap use-after-free vulnerability exists in PJSIP's event subscription framework (evsub.c) that is triggered during presence unsubscription (SUBSCRIBE with Expires=0). This issue has been patched in version 2.17.