EUVD-2026-71656Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable pre-auth via SIP INVITE with no user interaction; SRTP config requirement does not raise AC since attackers can identify SRTP endpoints; no confidentiality impact from the overflow itself.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer (sdes_encode_sdp() in transport_srtp_sdes.c). This affects applications with SRTP enabled (use_srtp optional or mandatory, using SDES keying). During media negotiation, the crypto attributes from the remote SDP are collected into a fixed-size array without bounding their number; a remote peer that includes an excessive number of a=crypto attributes in a single media description can write past the end of that array on the stack. This is reachable from an incoming SIP INVITE during offer/answer, before application-level authentication. Impact may range from unexpected application termination to control flow hijack/memory corruption. Applications that do not enable SRTP are not affected. This issue has been patched via commit a1b707c.
AnalysisAI
Stack-based buffer overflow in PJSIP's SRTP/SDES media transport allows a remote unauthenticated attacker to crash or potentially hijack control flow in any pjproject-based application with SRTP/SDES keying enabled. The flaw in sdes_encode_sdp() (transport_srtp_sdes.c) collects a=crypto attributes from a remote SDP offer into a fixed-size stack array without bounding the count, so a malicious SIP peer can overflow that array by including more attributes than it can hold. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | SRTP must be enabled in the pjproject application specifically using SDES keying (use_srtp set to PJ_MEDIA_SRTP_OPTIONAL or PJ_MEDIA_SRTP_MANDATORY); applications using DTLS-SRTP keying or no SRTP at all are not affected by this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N) accurately represents the attack surface: the flaw is network-reachable with no authentication and no required user interaction, meaning even a mid-sized municipal IT team in bytom running PJSIP-based SIP infrastructure should treat this as an urgent patching priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix from commit a1b707c (https://github.com/pjsip/pjproject/commit/a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9), which inserts a bounds check in `sdes_encode_sdp()` that returns `PJMEDIA_SRTP_ESDPINCRYPTO` when `cr_attr_count` reaches or exceeds `PJ_ARRAY_SIZE(tags)`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all applications and services in your environment using pjproject components (pjsip, pjsua, pjsua2) with SRTP/SDES enabled, map their network exposure, and segment SIP endpoints from untrusted networks where possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
PJSIP is a free and open source multimedia communication library. Rated critical severity (CVSS 9.1), this vulnerability
PJSIP is a free and open source multimedia communication library written in C language implementing standard based proto
An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Rated critical severity (CVSS 9
Buffer overflow in PJSIP multimedia library version 2.16 and earlier in PJNATH ICE implementation. Patch available. Affe
Heap overflow in PJSIP 2.16 and earlier DNS parser allows unauthenticated remote attackers to achieve code execution wit
PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, a
PJSIP is a free and open source multimedia communication library written in C language implementing standard based proto
PJSIP is a free and open source multimedia communication library written in C language implementing standard based proto
PJSIP is a free and open source multimedia communication library written in C. Rated critical severity (CVSS 9.8), this
PJSIP is a free and open source multimedia communication library written in C language implementing standard based proto
PJSIP is a free and open source multimedia communication library written in C. Rated critical severity (CVSS 9.8), this
PJSIP is a free and open source multimedia communication library written in C language. Rated critical severity (CVSS 9.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today