EUVD-2026-71660Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated telnet CLI; no confidentiality or integrity impact; availability limited to application crash requiring non-default CLI configuration.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 4472a31, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when rendering feedback for an entered command line. Several command-line handling paths write an attacker-influenced amount of data into fixed-size buffers without sufficient bounds checking, so a long command line can overflow them. This affects only applications that enable the telnet CLI front-end (e.g. pj_cli_telnet_create() / --cli-telnet-port). The telnet CLI is an interactive administration interface with no authentication, so any client able to reach it can already issue arbitrary CLI commands. A malformed or overly long command line can overflow a fixed-size stack buffer while rendering command-line feedback, which may lead to application termination. Because reaching this code already requires access to the unauthenticated CLI, the impact beyond that existing access is limited. Applications that do not enable the telnet CLI front-end are not affected. This issue has been patched via commit 4472a31.
AnalysisAI
Stack buffer overflow in PJSIP's (pjproject) telnet CLI front-end allows unauthenticated network attackers to crash applications that have explicitly enabled the telnet administration interface. The functions send_err_arg() and send_ambi_arg() in cli_telnet.c wrote an attacker-influenced number of bytes into a fixed 256-byte stack buffer without bounds checking, with the error-position offset derived directly from parsed command input. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two explicit prerequisites: (1) the target application must have opted into the PJSIP telnet CLI front-end by calling pj_cli_telnet_create() or using the --cli-telnet-port launch argument - this is a non-default feature absent from typical VoIP or SIP library deployments; (2) the attacker must have network-level connectivity to the telnet port. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.3 (Medium) is well-calibrated: the AT:P metric correctly captures that the telnet CLI is a non-default opt-in feature, and VA:L reflects that the confirmed worst-case outcome is application termination rather than arbitrary code execution or data compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix by updating to a pjproject build that incorporates commit 4472a31 (https://github.com/pjsip/pjproject/commit/4472a31d77a7506ff175dad5abef490f4e31bed1); a specific tagged release version containing this fix was not confirmed at time of analysis, so consult the vendor advisory GHSA-9c8q-h38q-p85j for the authoritative patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
PJSIP is a free and open source multimedia communication library. Rated critical severity (CVSS 9.1), this vulnerability
PJSIP is a free and open source multimedia communication library written in C language implementing standard based proto
An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Rated critical severity (CVSS 9
Buffer overflow in PJSIP multimedia library version 2.16 and earlier in PJNATH ICE implementation. Patch available. Affe
Heap overflow in PJSIP 2.16 and earlier DNS parser allows unauthenticated remote attackers to achieve code execution wit
PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, a
PJSIP is a free and open source multimedia communication library written in C language implementing standard based proto
PJSIP is a free and open source multimedia communication library written in C language implementing standard based proto
PJSIP is a free and open source multimedia communication library written in C. Rated critical severity (CVSS 9.8), this
PJSIP is a free and open source multimedia communication library written in C language implementing standard based proto
PJSIP is a free and open source multimedia communication library written in C. Rated critical severity (CVSS 9.8), this
PJSIP is a free and open source multimedia communication library written in C language. Rated critical severity (CVSS 9.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today