What is the CVSS score of CVE-2026-32942?

CVE-2026-32942 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Pjsip are affected by CVE-2026-32942?

A high-severity vulnerability in PJSIP (versions 2.16 and below) could allow attackers to corrupt memory and access sensitive information in organizations using this multimedia communication library.. A patch is available.

How to fix or mitigate CVE-2026-32942?

Within 24 hours: Inventory all systems running PJSIP 2.16 or below and assess their exposure level and network accessibility. Within 7 days: Implement network segmentation to isolate affected PJSIP services, disable ICE functionality if operationally feasible, and establish monitoring for exploitation attempts. Within 30 days: Evaluate upgrade paths to PJSIP 2.17+ (when released), consider alternative communication platforms if vendor remediation timeline is unacceptable, and conduct memory corruption/exploitation forensics on critical systems.

Pjsip CVE-2026-32942

EUVD-2026-13520 HIGH

Use After Free (CWE-416)

2026-03-20 security-advisories@github.com

Information Disclosure Use After Free Memory Corruption Pjsip

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13520

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 04:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below contain a heap use-after-free vulnerability in the ICE session that occurs when there are race conditions between session destruction and the callbacks. This issue has been fixed in version 2.17.

AnalysisAI

PJSIP versions 2.16 and earlier contain a heap use-after-free vulnerability in ICE session handling caused by race conditions between session destruction and callback execution, enabling memory corruption and potential code execution. This flaw affects all systems using vulnerable PJSIP versions for multimedia communication and currently has no available patch. With a CVSS score of 8.1, the vulnerability is remotely exploitable without authentication or user interaction.

Technical ContextAI

PJSIP is a widely-used open source multimedia communication library written in C that implements SIP, SDP, RTP, STUN, TURN, and ICE protocols for voice over IP and video conferencing applications. The vulnerability is classified as CWE-416 (Use After Free), occurring specifically in the Interactive Connectivity Establishment (ICE) session component. This memory safety flaw arises from improper synchronization where callback functions may attempt to access memory that has already been freed during session teardown, a classic race condition scenario in multithreaded C applications handling network protocol state machines. The affected component is pjproject (the project containing PJSIP) versions prior to 2.17.

RemediationAI

Upgrade PJSIP (pjproject) to version 2.17 or later, which contains the fix for this heap use-after-free vulnerability as documented in commit c9caceddabda7f18337b2a82d25d65f6224b450a available at https://github.com/pjsip/pjproject/commit/c9caceddabda7f18337b2a82d25d65f6224b450a. Organizations should review the official security advisory at https://github.com/pjsip/pjproject/security/advisories/GHSA-g88q-c2hm-q7p7 for complete upgrade guidance. If immediate patching is not feasible, implement network segmentation to limit exposure of PJSIP-based services to trusted networks only, deploy intrusion detection systems to monitor for abnormal ICE session behavior, and consider rate-limiting ICE connection establishment attempts to reduce the attack surface until the upgrade can be completed.