Is there a patch available for EUVD-2026-71659?

Yes, a patch is available for EUVD-2026-71659. Update the affected software to the latest version immediately.

PJSIP pjproject EUVD-2026-71659

Q: What is the CVSS score of EUVD-2026-71659?

EUVD-2026-71659 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-57165 MEDIUM

Stack-based Buffer Overflow (CWE-121)

2026-09-04 GitHub_M

Buffer Overflow Stack Overflow Pjsip Pjproject

6.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

AC:H reflects the non-default telnet CLI enable requirement; no C/I impact - only application crash (A:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Sep 04, 2026 - 19:18 EUVD

Source Code Evidence Fetched

Sep 04, 2026 - 18:07 vuln.today

Analysis Generated

Sep 04, 2026 - 18:07 vuln.today

DescriptionCVE.org

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 628b716, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when redrawing the command line during history recall (handle_up_down() in cli_telnet.c). This affects only applications that enable the telnet CLI front-end (same gating as the related CLI issue). The line-redraw sequence for a recalled history entry can accumulate more data than a fixed-size stack buffer holds, which may lead to application termination. Exploitation requires access to the unauthenticated telnet CLI, which already permits arbitrary CLI commands, so the additional impact is limited. Applications that do not enable the telnet CLI front-end are not affected. This issue has been patched via commit 628b716.

AnalysisAI

Stack-based buffer overflow in PJSIP pjproject's telnet CLI front-end allows remote, unauthenticated attackers to crash the affected application by sending history-recall input sequences (arrow keys) to the handle_up_down() function in cli_telnet.c. The accumulated redraw data - comprising cursor position, current buffer length, and recalled history entry length - can exceed the fixed-size PJ_CLI_MAX_CMDBUF stack buffer, leading to application termination. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The telnet CLI front-end must be explicitly enabled by the application - this is not a default PJSIP configuration and must be opted into at the application layer. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Real-world risk is low-to-moderate despite the network attack vector. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply commit 628b716 from the pjproject repository (https://github.com/pjsip/pjproject/commit/628b71638465bacf66e767959e6acbab822eccd6), which quadruples the stack buffer in `handle_up_down()` and adds per-term clamping. … Detailed patch versions, workarounds, and compensating controls in full report.