EUVD-2026-71659Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the non-default telnet CLI enable requirement; no C/I impact - only application crash (A:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 628b716, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when redrawing the command line during history recall (handle_up_down() in cli_telnet.c). This affects only applications that enable the telnet CLI front-end (same gating as the related CLI issue). The line-redraw sequence for a recalled history entry can accumulate more data than a fixed-size stack buffer holds, which may lead to application termination. Exploitation requires access to the unauthenticated telnet CLI, which already permits arbitrary CLI commands, so the additional impact is limited. Applications that do not enable the telnet CLI front-end are not affected. This issue has been patched via commit 628b716.
AnalysisAI
Stack-based buffer overflow in PJSIP pjproject's telnet CLI front-end allows remote, unauthenticated attackers to crash the affected application by sending history-recall input sequences (arrow keys) to the handle_up_down() function in cli_telnet.c. The accumulated redraw data - comprising cursor position, current buffer length, and recalled history entry length - can exceed the fixed-size PJ_CLI_MAX_CMDBUF stack buffer, leading to application termination. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The telnet CLI front-end must be explicitly enabled by the application - this is not a default PJSIP configuration and must be opted into at the application layer. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is low-to-moderate despite the network attack vector. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply commit 628b716 from the pjproject repository (https://github.com/pjsip/pjproject/commit/628b71638465bacf66e767959e6acbab822eccd6), which quadruples the stack buffer in `handle_up_down()` and adds per-term clamping. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stack buffer overflow in PJSIP's GnuTLS TLS backend allows a network-positioned attacker to corrupt memory or hijack con
Stack-based buffer overflow in PJSIP's SRTP/SDES media transport allows a remote unauthenticated attacker to crash or po
Stack buffer overflow in PJSIP's PJSUA library allows a malicious or compromised SIP registrar to crash applications - o
Heap buffer overflow in PJSIP 2.16 and earlier allows local attackers with user interaction to execute arbitrary code or
Out-of-bounds memory corruption in PJSIP pjproject's SDP negotiator allows a remote unauthenticated attacker to trigger
Heap buffer overflow in PJSIP pjproject's PJLIB-UTIL HTTP client allows a malicious or man-in-the-middle HTTP server to
Certificate validation bypass in PJSIP versions before 2.17 allows remote attackers to perform man-in-the-middle attacks
Integer overflow in PJSIP 2.16 and earlier enables remote unauthenticated attackers to trigger memory corruption or appl
Stack buffer overflow in PJSIP (pjproject) 2.16 and earlier occurs in pjsip_auth_create_digest2() when an application au
PJSIP versions 2.16 and below contain a cascading out-of-bounds heap read vulnerability in the pjsip_multipart_parse() f
Heap out-of-bounds read in PJSIP's VP9 RTP unpacketizer allows remote attackers to read memory beyond allocated buffer b
Off-by-one buffer overflow in pjproject's SIP message serialization function allows a remote peer to trigger a single-by
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today