What is the CVSS score of CVE-2026-32945?

CVE-2026-32945 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Pjsip are affected by CVE-2026-32945?

A high-severity vulnerability in PJSIP's DNS parser affects organizations running versions 2.16 and below, potentially allowing remote attackers to cause service outages or access sensitive data…. A patch is available.

How to fix or mitigate CVE-2026-32945?

Within 24 hours: Inventory all systems running PJSIP versions 2.16 and below and confirm which have DNS resolver functionality enabled. Within 7 days: Implement network segmentation to restrict DNS traffic to trusted internal resolvers only, and disable external DNS resolution in PJSIP configuration if business operations permit. Within 30 days: Evaluate upgrade paths to PJSIP 2.17+ once available, or consider alternative communication platforms; monitor vendor advisories for patch release and deploy immediately upon availability.

Pjsip CVE-2026-32945

EUVD-2026-13519 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-03-20 security-advisories@github.com

Buffer Overflow Heap Overflow Pjsip

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13519

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 04:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a Heap-based Buffer Overflowvulnerability in the DNS parser's name length handler. Thisimpacts applications using PJSIP's built-in DNS resolver, such as those configured with pjsua_config.nameserver or UaConfig.nameserver in PJSUA/PJSUA2. It does not affect users who rely on the OS resolver (e.g., getaddrinfo()) by not configuring a nameserver, or those using an external resolver via pjsip_resolver_set_ext_resolver(). This issue is fixed in version 2.17. For users unable to upgrade, a workaround is to disable DNS resolution in the PJSIP config (by setting nameserver_count to zero) or to use an external resolver implementation instead.

AnalysisAI

Heap overflow in PJSIP 2.16 and earlier DNS parser allows unauthenticated remote attackers to achieve code execution with no user interaction required. The vulnerability affects only applications explicitly configured with a built-in nameserver; users relying on OS resolvers or external resolver implementations are unaffected. No patch is currently available, but mitigation is possible by disabling DNS resolution or switching to an external resolver.

Technical ContextAI

PJSIP is a widely-used free and open-source multimedia communication library written in C, commonly integrated into VoIP applications, SIP clients, and telephony systems. The vulnerability, classified as CWE-122 (Heap-based Buffer Overflow), occurs in the DNS parser component specifically when handling name length validation during DNS response processing. According to EUVD-2026-13519, affected versions include pjproject versions prior to 2.17. The flaw only impacts deployments that utilize PJSIP's internal DNS resolver implementation rather than delegating to the operating system's native resolver (getaddrinfo) or external resolver implementations via pjsip_resolver_set_ext_resolver(). The heap overflow occurs during parsing of DNS records, likely when processing malformed or specially crafted DNS response packets with incorrect length fields.

RemediationAI

Upgrade PJSIP (pjproject) to version 2.17 or later, which contains the fix committed at https://github.com/pjsip/pjproject/commit/5311aee398ae9d623829a6bad7b679a193c9e199. For environments where immediate patching is not feasible, implement one of two workarounds: disable DNS resolution in PJSIP configuration by setting nameserver_count to zero (forcing reliance on OS resolver), or configure an external resolver implementation using pjsip_resolver_set_ext_resolver() function. Review your PJSIP deployment to confirm whether custom nameservers are configured, as systems using default OS resolver settings (getaddrinfo) are not affected and do not require remediation. Consult the GitHub security advisory at https://github.com/pjsip/pjproject/security/advisories/GHSA-jr2p-p2w4-rr9q for complete vendor recommendations.