Which versions of PJSIP are affected by CVE-2026-40892?

PJSIP telecommunications library versions 2.16 and earlier contain a memory corruption vulnerability (CVSS 8.1) affecting SIP authentication that could disrupt voice services or compromise calling…

How to fix or mitigate CVE-2026-40892?

Within 24 hours: identify all PJSIP 2.16 and earlier deployments in your SIP infrastructure using asset discovery and configuration management databases. Within 7 days: implement firewall rules to restrict SIP traffic to authorized endpoints only, and disable pre-computed digest authentication if operational alternatives are available. Within 30 days: monitor PJSIP releases for security patches; plan and execute migration to patched versions or alternative SIP libraries; validate all changes in non-production before production deployment.

PJSIP CVE-2026-40892

Q: What is the CVSS score of CVE-2026-40892?

CVE-2026-40892 has a CVSS 4.0 base score of 8.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-24469 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-21 GitHub_M

Buffer Overflow Stack Overflow Pjsip Pjproject

8.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.7 MEDIUM

Overflow is driven by an operator/application-provisioned digest credential, so an attacker must control that config data (PR:H) via a local/config path (AV:L); memory corruption yields high C/I/A.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:06 vuln.today

Analysis Generated

Jul 24, 2026 - 07:06 vuln.today

CVSS changed

Apr 21, 2026 - 21:22 NVD

8.1 (HIGH)

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24469

CVE Published

Apr 21, 2026 - 19:55 nvd

HIGH 8.1

DescriptionGitHub Advisory

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsip_auth_create_digest2() in PJSIP when using pre-computed digest credentials (PJSIP_CRED_DATA_DIGEST). The function copies credential data using cred_info->data.slen as the length without an upper-bound check, which can overflow the fixed-size ha1 stack buffer (128 bytes) if data.slen exceeds the expected digest string length.

AnalysisAI

Stack buffer overflow in PJSIP (pjproject) 2.16 and earlier occurs in pjsip_auth_create_digest2() when an application authenticates using pre-computed digest credentials (PJSIP_CRED_DATA_DIGEST). The function pj_memcpy's cred_info->data.slen bytes into a fixed 128-byte ha1 stack buffer with no upper-bound check (CWE-121), so an over-length credential string corrupts adjacent stack memory and can cause a crash or potentially code execution. No public exploit identified at time of analysis; EPSS is very low (0.04%, 13th percentile) and it is not in CISA KEV, though CISA SSVC rates technical impact as total and automatable as yes.

Technical ContextAI

PJSIP/pjproject is a widely embedded open-source C library implementing SIP, SDP, RTP/RTCP, STUN, ICE and related VoIP/multimedia signaling; it is the SIP stack underneath Asterisk chan_pjsip and many softphones, SBCs, and embedded VoIP endpoints. The defect lives in the SIP digest authentication client path (sip_auth_client.c). When credentials are supplied as credential-data type PJSIP_CRED_DATA_DIGEST, the caller passes a pre-computed HA1 digest value rather than a plaintext password, and pjsip_auth_create_digest2() copies that value into a fixed 128-byte on-stack ha1 buffer. A legitimate MD5 HA1 is a 32-character hex string (SHA variants longer but still bounded), so the buffer is generously sized for valid input. The root cause is CWE-121 (stack-based buffer overflow): the copy length is taken from the supplied data.slen instead of the expected digest_strlen, allowing writes past the buffer. The upstream fix (commit c82123ea) changes pj_memcpy to use digest_strlen as the bounded length.

RemediationAI

Upstream fix available (commit c82123ea6f3c3652bbc9ebd5e9e658c301451687); a released, tagged patched version is not independently confirmed from the provided data, so track the vendor advisory GHSA-2wcg-w3c4-48r7 (https://github.com/pjsip/pjproject/security/advisories/GHSA-2wcg-w3c4-48r7) for the patched release and rebuild any product that statically links pjproject. The code fix bounds the copy to digest_strlen instead of cred_info->data.slen (https://github.com/pjsip/pjproject/commit/c82123ea6f3c3652bbc9ebd5e9e658c301451687). Until a tagged release is applied, the most direct compensating control is to avoid the vulnerable code path: where feasible use plaintext password credentials (PJSIP_CRED_DATA_PLAIN_PASSWD) instead of PJSIP_CRED_DATA_DIGEST pre-computed digests, which sidesteps the unchecked copy at the cost of handling/storing plaintext secrets; alternatively, validate and cap the length of any pre-computed digest credential (to the expected 32-hex-char MD5 HA1 or the relevant SHA length) before passing it into pjsip_auth_create_digest2(), and restrict and verify the trustworthiness of whatever source provisions those credentials. Backporting the one-line commit into your own build is the cleanest interim mitigation if you compile pjproject yourself.