Is there a patch available for EUVD-2026-25597?

Yes, a patch is available for EUVD-2026-25597. Update the affected software to the latest version immediately.

PJSIP pjproject EUVD-2026-25597

Q: What is the CVSS score of EUVD-2026-25597?

EUVD-2026-25597 has a CVSS 4.0 base score of 6.7 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-41415 MEDIUM

Out-of-bounds Read (CWE-125)

2026-04-24 GitHub_M

Buffer Overflow Information Disclosure Pjsip Pjproject

6.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.7 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Network-reachable with no auth or interaction; OOB read primarily crashes the SIP parser (A:H) with a minor integrity side-effect (I:L) and no confirmed memory disclosure (C:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 02:22 vuln.today

Analysis Generated

Jul 24, 2026 - 02:22 vuln.today

Patch released

Apr 28, 2026 - 18:30 nvd

Patch available

Apr 24, 2026 - 20:17 EUVD

CVSS changed

Apr 24, 2026 - 19:22 NVD

6.7 (MEDIUM)

EUVD ID Assigned

Apr 24, 2026 - 19:00 euvd

EUVD-2026-25597

CVE Published

Apr 24, 2026 - 18:38 nvd

MEDIUM 6.7

DescriptionGitHub Advisory

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an out-of-bounds read when parsing a malformed Content-ID URI in SIP multipart message body. Insufficient length validation can cause reads beyond the intended buffer bounds. This vulnerability is fixed in 2.17.

AnalysisAI

Out-of-bounds read in PJSIP pjproject 2.16 and earlier exposes SIP endpoints to remote crash and limited memory integrity corruption via a malformed Content-ID URI in a SIP multipart message body. The vulnerability requires no authentication and no user interaction, making it automatable per SSVC analysis, though exploitation probability remains very low (EPSS 0.04%, 11th percentile) with no public exploit or active exploitation recorded. The primary risk is availability - a crafted SIP multipart packet can crash the parsing component - with a secondary low-severity integrity signal per the CVSS 4.0 vector (VI:L); confidentiality impact is assessed as none.

Technical ContextAI

PJSIP (pjproject), a free and open-source C-based SIP/media stack used widely in VoIP platforms, implements SIP multipart body parsing in sip_multipart.c. The vulnerable function cid_uri_to_hdr_value() processes Content-ID URIs embedded in multipart SIP bodies. CWE-125 (Out-of-Bounds Read) applies: the function failed to initialize the return struct (pj_str_t cid_hdr) and lacked a minimum-length guard on uri_overlay.slen before accessing memory. The fix in commit 4225a93c initializes cid_hdr to zero and inserts an early return if uri_overlay.slen < 2, preventing reads beyond the buffer. Affected CPE: cpe:2.3:a:pjsip:pjproject:*:*:*:*:*:*:*:* covering all versions up to and including 2.16.

RemediationAI

Upgrade to pjproject 2.17, which contains the fix introduced in commit 4225a93c16661538005017883fbc8f1ea1d5f4b0 (https://github.com/pjsip/pjproject/commit/4225a93c16661538005017883fbc8f1ea1d5f4b0). The vendor advisory is at https://github.com/pjsip/pjproject/security/advisories/GHSA-935m-fmf5-j4pm. If upgrading immediately is not possible, a targeted compensating control is to block or discard inbound SIP messages with multipart Content-Type bodies at the SIP proxy or session border controller layer - trade-off is that legitimate SIP multipart messages (used in some REFER and MESSAGE flows) will be dropped, which may affect specific call features. If SIP multipart is not used in the deployment, disabling or filtering it at the perimeter carries no functional cost.