EUVD-2026-71653Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Non-default compile-time flag required raises AC to H; no authentication needed for SIP SDP exchange; OOB write corrupts memory (I:H) and crashes process (A:H), OOB read leaks some memory (C:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6DescriptionCVE.org
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c uses payload-type numbers taken from a remote SDP offer or answer to index fixed-size internal tables without sufficient bounds validation, so a crafted remote SDP can cause memory access outside those tables. The practical impact is memory corruption and denial of service; code execution is not demonstrated. This path is only reached when PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP is enabled. The default is disabled, so default builds are not affected; the feature is an interoperability option that integrating products may enable. This issue has been patched via commit 673b978.
AnalysisAI
Out-of-bounds memory corruption in PJSIP pjproject's SDP negotiator allows a remote unauthenticated attacker to trigger memory corruption and denial of service by sending a crafted SDP offer or answer containing out-of-range payload-type numbers. The root defect is in assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c, where PT numbers from remote SDP are used as fixed-size array indices with only a lower-bound check, not an upper-bound check. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target application must be compiled with the non-default PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP compile-time flag explicitly enabled - this is an opt-in interoperability feature, and default pjproject builds do not compile in the vulnerable code path at all; (2) the attacker must be able to reach the SIP signaling interface and induce the application to process a crafted SDP, which occurs naturally during SIP call setup without authentication (CVSS PR:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.4 with AT:P (attack requirements present) accurately reflects the configuration-dependent nature of this vulnerability - without PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP enabled, the vulnerable code path is never reached and the effective risk is zero for the majority of deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The upstream fix is available in commit 673b978 (https://github.com/pjsip/pjproject/commit/673b978aab1fe3ab874247be32c871acc880cbeb); a specific tagged release version incorporating this fix has not been confirmed from the available data - organizations should verify with the pjproject release log or pin directly to this commit. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your infrastructure to identify any instances of PJSIP pjproject and verify the compilation flags used-specifically whether PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP is enabled; if you deploy standard, unmodified PJSIP builds, no remediation is required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
PJSIP is a free and open source multimedia communication library. Rated critical severity (CVSS 9.1), this vulnerability
PJSIP is a free and open source multimedia communication library written in C language implementing standard based proto
An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Rated critical severity (CVSS 9
Buffer overflow in PJSIP multimedia library version 2.16 and earlier in PJNATH ICE implementation. Patch available. Affe
Heap overflow in PJSIP 2.16 and earlier DNS parser allows unauthenticated remote attackers to achieve code execution wit
PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, a
PJSIP is a free and open source multimedia communication library written in C language implementing standard based proto
PJSIP is a free and open source multimedia communication library written in C language implementing standard based proto
PJSIP is a free and open source multimedia communication library written in C. Rated critical severity (CVSS 9.8), this
PJSIP is a free and open source multimedia communication library written in C language implementing standard based proto
PJSIP is a free and open source multimedia communication library written in C. Rated critical severity (CVSS 9.8), this
PJSIP is a free and open source multimedia communication library written in C language. Rated critical severity (CVSS 9.
Same weakness CWE-129 – Improper Validation of Array Index
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today