Skip to main content

PJSIP pjproject CVE-2026-57160

| EUVDEUVD-2026-71654 MEDIUM
Off-by-one Error (CWE-193)
2026-09-04 GitHub_M
Buffer Overflow Pjsip Pjproject
6.9
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.8 MEDIUM

Network-reachable and unauthenticated, but AC:H reflects the precise buffer-boundary alignment required to trigger the off-by-one; no confidentiality impact per vendor.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Metadata Corrected
Sep 04, 2026 - 18:40 vuln.today
tag: Information Disclosure removed
Metadata Corrected
Sep 04, 2026 - 18:40 vuln.today
tag: RCE removed
Source Code Evidence Fetched
Sep 04, 2026 - 18:07 vuln.today
Analysis Generated
Sep 04, 2026 - 18:07 vuln.today

DescriptionCVE.org

PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c, the function that serializes generic array headers (such as Allow, Require, Supported, and Unsupported). Under certain output-buffer boundary conditions the function can write one byte past the end of the buffer. This is reachable mainly in applications that parse and re-serialize incoming SIP requests - for example a proxy, SBC, or B2BUA - where a remote peer can influence the serialized message. The out-of-bounds write is a single fixed byte; code execution and information disclosure are not demonstrated, and in typical pool-based allocations the byte falls within allocation slack. This issue has been patched via commit d6a0e7f.

AnalysisAI

Off-by-one buffer overflow in pjproject's SIP message serialization function allows a remote peer to trigger a single-byte out-of-bounds write by sending crafted SIP requests to a proxy, SBC, or B2BUA that parses and re-serializes messages using the PJSIP library. The vulnerable function pjsip_generic_array_hdr_print() in sip_msg.c omitted bounds checking before writing the colon and space characters that follow generic array header names (Allow, Require, Supported, Unsupported), resulting in CWE-193 off-by-one writes at exact buffer boundaries. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application uses pjproject as its SIP library AND performs both parsing and re-serialization of incoming SIP messages - this is characteristic of SIP proxies, session border controllers (SBCs), and back-to-back user agents (B2BUAs) but not of simple SIP endpoints that only generate their own messages. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Real-world risk is moderate and nuanced. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the upstream fix by updating pjproject to a build incorporating commit d6a0e7f76611c3a6f530ee051e3e7a622bb1748c (https://github.com/pjsip/pjproject/commit/d6a0e7f76611c3a6f530ee051e3e7a622bb1748c); a downstream tagged release incorporating this fix is not independently confirmed at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Pjsip

View all
CVE-2021-43845 CRITICAL POC
9.1 Dec 27

PJSIP is a free and open source multimedia communication library. Rated critical severity (CVSS 9.1), this vulnerability
CVE-2021-21375 MEDIUM POC
6.5 Mar 10

PJSIP is a free and open source multimedia communication library written in C language implementing standard based proto
CVE-2017-16872 CRITICAL
9.8 Nov 17

An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Rated critical severity (CVSS 9
CVE-2026-25994 CRITICAL POC
9.8 Feb 11

Buffer overflow in PJSIP multimedia library version 2.16 and earlier in PJNATH ICE implementation. Patch available. Affe
CVE-2026-32945 CRITICAL
9.8 Mar 20

Heap overflow in PJSIP 2.16 and earlier DNS parser allows unauthenticated remote attackers to achieve code execution wit
CVE-2023-38703 CRITICAL
9.8 Oct 06

PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, a
CVE-2022-23547 CRITICAL
9.8 Dec 23

PJSIP is a free and open source multimedia communication library written in C language implementing standard based proto
CVE-2022-23537 CRITICAL
9.8 Dec 20

PJSIP is a free and open source multimedia communication library written in C language implementing standard based proto
CVE-2022-39244 CRITICAL
9.8 Oct 06

PJSIP is a free and open source multimedia communication library written in C. Rated critical severity (CVSS 9.8), this

CVE-2022-31031 CRITICAL
9.8 Jun 09

PJSIP is a free and open source multimedia communication library written in C language implementing standard based proto
CVE-2022-24786 CRITICAL
9.8 Apr 06

PJSIP is a free and open source multimedia communication library written in C. Rated critical severity (CVSS 9.8), this

CVE-2022-24754 CRITICAL
9.8 Mar 11

PJSIP is a free and open source multimedia communication library written in C language. Rated critical severity (CVSS 9.

Same weakness CWE-193 – Off-by-one Error

View all
CVE-2021-3156 HIGH POC
7.8
CVE-2022-34970 CRITICAL POC
9.8
CVE-2021-31875 CRITICAL POC
9.8
CVE-2020-8443 CRITICAL POC
9.8
CVE-2019-14532 CRITICAL POC
9.8
CVE-2026-86297 HIGH POC
8.2
CVE-2019-13306 HIGH POC
7.8
CVE-2019-13305 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Share

CVE-2026-57160 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy