Pjproject
Monthly
Heap buffer overflow in PJSIP pjproject's PJLIB-UTIL HTTP client allows a malicious or man-in-the-middle HTTP server to corrupt application heap memory or terminate the process by delivering a response body larger than twice the Content-Length-derived initial allocation. The flaw resides in http_client.c where the buffer growth logic performed only a single doubling, which is insufficient when the server-supplied Content-Length substantially underestimates the actual body size, causing pj_memcpy() to write beyond the allocation boundary. Only applications using the non-incremental whole-body completion callback are affected; the fix (commit 8d5956a) replaces single-doubling with a loop that guarantees the buffer fits the incoming data before any copy occurs.
Stack buffer overflow in PJSIP's GnuTLS TLS backend allows a network-positioned attacker to corrupt memory or hijack control flow by presenting a crafted X.509 certificate with an oversized Subject Alternative Name entry during TLS handshake. Only builds compiled with GnuTLS (--with-gnutls) are affected; OpenSSL and Apple SecureTransport/Network.framework builds are explicitly unaffected. The vulnerability triggers before any SIP-level authentication, making it exploitable against both clients (connecting to a malicious server) and servers that request client certificates, with impact ranging from application termination to potential arbitrary code execution. No public exploit has been identified at time of analysis; upstream fix is available via commit c4a151a.
Stack-based buffer overflow in PJSIP's SRTP/SDES media transport allows a remote unauthenticated attacker to crash or potentially hijack control flow in any pjproject-based application with SRTP/SDES keying enabled. The flaw in `sdes_encode_sdp()` (transport_srtp_sdes.c) collects `a=crypto` attributes from a remote SDP offer into a fixed-size stack array without bounding the count, so a malicious SIP peer can overflow that array by including more attributes than it can hold. The vulnerability is reachable from an incoming SIP INVITE before application-level authentication, and a fix is available as upstream commit a1b707c; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in PJSIP's PJSUA library allows a malicious or compromised SIP registrar to crash applications - or potentially corrupt memory - by returning an excessive number of Service-Route headers in a 2xx registration response. The vulnerability affects all applications using the PJSUA/PJSUA2 account API (the default registration path) prior to commit acc03b5 in pjproject. The most likely outcome is denial of service via unexpected termination; however, because the overflow writes internal stack pointers rather than attacker-controlled bytes, arbitrary code execution is considered less probable though not excluded. No public exploit code or CISA KEV listing is present at time of analysis.
Out-of-bounds memory corruption in PJSIP pjproject's SDP negotiator allows a remote unauthenticated attacker to trigger memory corruption and denial of service by sending a crafted SDP offer or answer containing out-of-range payload-type numbers. The root defect is in assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c, where PT numbers from remote SDP are used as fixed-size array indices with only a lower-bound check, not an upper-bound check. Exploitation requires the non-default compile-time flag PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP to be enabled; default builds are entirely unaffected, no public exploit has been identified, and code execution has not been demonstrated.
Certificate validation bypass in PJSIP versions before 2.17 allows remote attackers to perform man-in-the-middle attacks against TLS connections when built with GnuTLS. Despite applications explicitly enabling certificate verification through verify_server or verify_client flags, the SIP TLS transport accepts connections with invalid or untrusted certificates, exposing SIP signaling to interception and manipulation. Vendor-released patch available in version 2.17 with GitHub commit ef684252. No public exploit identified at time of analysis, though the vulnerability is straightforward to exploit given the network attack vector and low complexity (CVSS:4.0 AV:N/AC:L/PR:N).
Integer overflow in PJSIP 2.16 and earlier enables remote unauthenticated attackers to trigger memory corruption or application crashes via malicious SDP packets with asymmetric ptime values. The vulnerability causes undersized buffer allocation during media stream processing, creating conditions for memory corruption with potential code execution or denial of service. Fixed in version 2.17 with no public exploit identified at time of analysis, though CVSS 8.1 and network attack vector indicate significant risk for internet-facing VoIP/multimedia applications.
Stack buffer overflow in PJSIP (pjproject) 2.16 and earlier occurs in pjsip_auth_create_digest2() when an application authenticates using pre-computed digest credentials (PJSIP_CRED_DATA_DIGEST). The function pj_memcpy's cred_info->data.slen bytes into a fixed 128-byte ha1 stack buffer with no upper-bound check (CWE-121), so an over-length credential string corrupts adjacent stack memory and can cause a crash or potentially code execution. No public exploit identified at time of analysis; EPSS is very low (0.04%, 13th percentile) and it is not in CISA KEV, though CISA SSVC rates technical impact as total and automatable as yes.
Heap buffer overflow in PJSIP 2.16 and earlier allows local attackers with user interaction to execute arbitrary code or crash the application via maliciously crafted Opus audio frames. The vulnerability stems from undersized FEC decode buffers (960 bytes at 8 kHz mono) that receive up to 1280 bytes of encoded data without bounds checking during Opus codec decoding. With CVSS 8.5 severity and a public GitHub commit fix available, this represents a high-impact memory corruption vulnerability in a widely-deployed VoIP library, though exploitation requires local access and user interaction (AV:L/UI:P), limiting remote attack scenarios.
PJSIP versions 2.16 and below contain a cascading out-of-bounds heap read vulnerability in the pjsip_multipart_parse() function that allows attackers to read 1-2 bytes of adjacent heap memory when processing SIP messages with multipart bodies or SDP content. The vulnerability affects all applications using PJSIP to process incoming SIP messages, as the flaw does not require authentication or user interaction and can be triggered remotely over the network. While the CVSS score of 6.9 reflects moderate severity with low confidentiality impact, the low attack complexity and remote exploitability make this a practical concern for SIP-based communication systems.
Stack buffer overflow in PJSIP's (pjproject) telnet CLI front-end allows unauthenticated network attackers to crash applications that have explicitly enabled the telnet administration interface. The functions send_err_arg() and send_ambi_arg() in cli_telnet.c wrote an attacker-influenced number of bytes into a fixed 256-byte stack buffer without bounds checking, with the error-position offset derived directly from parsed command input. The vulnerability is limited to application termination (DoS); no public exploit code has been identified at time of analysis, and the upstream fix is available as commit 4472a31.
Stack-based buffer overflow in PJSIP pjproject's telnet CLI front-end allows remote, unauthenticated attackers to crash the affected application by sending history-recall input sequences (arrow keys) to the `handle_up_down()` function in `cli_telnet.c`. The accumulated redraw data - comprising cursor position, current buffer length, and recalled history entry length - can exceed the fixed-size `PJ_CLI_MAX_CMDBUF` stack buffer, leading to application termination. Exploitation requires the telnet CLI front-end to be explicitly enabled; applications that do not enable this feature are entirely unaffected, and no public exploit or KEV listing has been identified at time of analysis.
Off-by-one buffer overflow in pjproject's SIP message serialization function allows a remote peer to trigger a single-byte out-of-bounds write by sending crafted SIP requests to a proxy, SBC, or B2BUA that parses and re-serializes messages using the PJSIP library. The vulnerable function `pjsip_generic_array_hdr_print()` in `sip_msg.c` omitted bounds checking before writing the colon and space characters that follow generic array header names (Allow, Require, Supported, Unsupported), resulting in CWE-193 off-by-one writes at exact buffer boundaries. No public exploit has been identified at time of analysis; the vendor explicitly states that code execution and information disclosure have not been demonstrated, and pool-based allocator slack typically absorbs the errant byte harmlessly.
Out-of-bounds read in PJSIP pjproject 2.16 and earlier exposes SIP endpoints to remote crash and limited memory integrity corruption via a malformed Content-ID URI in a SIP multipart message body. The vulnerability requires no authentication and no user interaction, making it automatable per SSVC analysis, though exploitation probability remains very low (EPSS 0.04%, 11th percentile) with no public exploit or active exploitation recorded. The primary risk is availability - a crafted SIP multipart packet can crash the parsing component - with a secondary low-severity integrity signal per the CVSS 4.0 vector (VI:L); confidentiality impact is assessed as none.
Heap out-of-bounds read in PJSIP's VP9 RTP unpacketizer allows remote attackers to read memory beyond allocated buffer boundaries by sending crafted VP9 Scalability Structure data, potentially disclosing sensitive information. PJSIP versions prior to 2.17 are affected. The vulnerability requires network access but no authentication, authentication complexity, or user interaction, with CVSS score of 6.9 indicating moderate severity driven by availability impact. Vendor-released patch available in version 2.17.
Heap buffer overflow in PJSIP pjproject's PJLIB-UTIL HTTP client allows a malicious or man-in-the-middle HTTP server to corrupt application heap memory or terminate the process by delivering a response body larger than twice the Content-Length-derived initial allocation. The flaw resides in http_client.c where the buffer growth logic performed only a single doubling, which is insufficient when the server-supplied Content-Length substantially underestimates the actual body size, causing pj_memcpy() to write beyond the allocation boundary. Only applications using the non-incremental whole-body completion callback are affected; the fix (commit 8d5956a) replaces single-doubling with a loop that guarantees the buffer fits the incoming data before any copy occurs.
Stack buffer overflow in PJSIP's GnuTLS TLS backend allows a network-positioned attacker to corrupt memory or hijack control flow by presenting a crafted X.509 certificate with an oversized Subject Alternative Name entry during TLS handshake. Only builds compiled with GnuTLS (--with-gnutls) are affected; OpenSSL and Apple SecureTransport/Network.framework builds are explicitly unaffected. The vulnerability triggers before any SIP-level authentication, making it exploitable against both clients (connecting to a malicious server) and servers that request client certificates, with impact ranging from application termination to potential arbitrary code execution. No public exploit has been identified at time of analysis; upstream fix is available via commit c4a151a.
Stack-based buffer overflow in PJSIP's SRTP/SDES media transport allows a remote unauthenticated attacker to crash or potentially hijack control flow in any pjproject-based application with SRTP/SDES keying enabled. The flaw in `sdes_encode_sdp()` (transport_srtp_sdes.c) collects `a=crypto` attributes from a remote SDP offer into a fixed-size stack array without bounding the count, so a malicious SIP peer can overflow that array by including more attributes than it can hold. The vulnerability is reachable from an incoming SIP INVITE before application-level authentication, and a fix is available as upstream commit a1b707c; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in PJSIP's PJSUA library allows a malicious or compromised SIP registrar to crash applications - or potentially corrupt memory - by returning an excessive number of Service-Route headers in a 2xx registration response. The vulnerability affects all applications using the PJSUA/PJSUA2 account API (the default registration path) prior to commit acc03b5 in pjproject. The most likely outcome is denial of service via unexpected termination; however, because the overflow writes internal stack pointers rather than attacker-controlled bytes, arbitrary code execution is considered less probable though not excluded. No public exploit code or CISA KEV listing is present at time of analysis.
Out-of-bounds memory corruption in PJSIP pjproject's SDP negotiator allows a remote unauthenticated attacker to trigger memory corruption and denial of service by sending a crafted SDP offer or answer containing out-of-range payload-type numbers. The root defect is in assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c, where PT numbers from remote SDP are used as fixed-size array indices with only a lower-bound check, not an upper-bound check. Exploitation requires the non-default compile-time flag PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP to be enabled; default builds are entirely unaffected, no public exploit has been identified, and code execution has not been demonstrated.
Certificate validation bypass in PJSIP versions before 2.17 allows remote attackers to perform man-in-the-middle attacks against TLS connections when built with GnuTLS. Despite applications explicitly enabling certificate verification through verify_server or verify_client flags, the SIP TLS transport accepts connections with invalid or untrusted certificates, exposing SIP signaling to interception and manipulation. Vendor-released patch available in version 2.17 with GitHub commit ef684252. No public exploit identified at time of analysis, though the vulnerability is straightforward to exploit given the network attack vector and low complexity (CVSS:4.0 AV:N/AC:L/PR:N).
Integer overflow in PJSIP 2.16 and earlier enables remote unauthenticated attackers to trigger memory corruption or application crashes via malicious SDP packets with asymmetric ptime values. The vulnerability causes undersized buffer allocation during media stream processing, creating conditions for memory corruption with potential code execution or denial of service. Fixed in version 2.17 with no public exploit identified at time of analysis, though CVSS 8.1 and network attack vector indicate significant risk for internet-facing VoIP/multimedia applications.
Stack buffer overflow in PJSIP (pjproject) 2.16 and earlier occurs in pjsip_auth_create_digest2() when an application authenticates using pre-computed digest credentials (PJSIP_CRED_DATA_DIGEST). The function pj_memcpy's cred_info->data.slen bytes into a fixed 128-byte ha1 stack buffer with no upper-bound check (CWE-121), so an over-length credential string corrupts adjacent stack memory and can cause a crash or potentially code execution. No public exploit identified at time of analysis; EPSS is very low (0.04%, 13th percentile) and it is not in CISA KEV, though CISA SSVC rates technical impact as total and automatable as yes.
Heap buffer overflow in PJSIP 2.16 and earlier allows local attackers with user interaction to execute arbitrary code or crash the application via maliciously crafted Opus audio frames. The vulnerability stems from undersized FEC decode buffers (960 bytes at 8 kHz mono) that receive up to 1280 bytes of encoded data without bounds checking during Opus codec decoding. With CVSS 8.5 severity and a public GitHub commit fix available, this represents a high-impact memory corruption vulnerability in a widely-deployed VoIP library, though exploitation requires local access and user interaction (AV:L/UI:P), limiting remote attack scenarios.
PJSIP versions 2.16 and below contain a cascading out-of-bounds heap read vulnerability in the pjsip_multipart_parse() function that allows attackers to read 1-2 bytes of adjacent heap memory when processing SIP messages with multipart bodies or SDP content. The vulnerability affects all applications using PJSIP to process incoming SIP messages, as the flaw does not require authentication or user interaction and can be triggered remotely over the network. While the CVSS score of 6.9 reflects moderate severity with low confidentiality impact, the low attack complexity and remote exploitability make this a practical concern for SIP-based communication systems.
Stack buffer overflow in PJSIP's (pjproject) telnet CLI front-end allows unauthenticated network attackers to crash applications that have explicitly enabled the telnet administration interface. The functions send_err_arg() and send_ambi_arg() in cli_telnet.c wrote an attacker-influenced number of bytes into a fixed 256-byte stack buffer without bounds checking, with the error-position offset derived directly from parsed command input. The vulnerability is limited to application termination (DoS); no public exploit code has been identified at time of analysis, and the upstream fix is available as commit 4472a31.
Stack-based buffer overflow in PJSIP pjproject's telnet CLI front-end allows remote, unauthenticated attackers to crash the affected application by sending history-recall input sequences (arrow keys) to the `handle_up_down()` function in `cli_telnet.c`. The accumulated redraw data - comprising cursor position, current buffer length, and recalled history entry length - can exceed the fixed-size `PJ_CLI_MAX_CMDBUF` stack buffer, leading to application termination. Exploitation requires the telnet CLI front-end to be explicitly enabled; applications that do not enable this feature are entirely unaffected, and no public exploit or KEV listing has been identified at time of analysis.
Off-by-one buffer overflow in pjproject's SIP message serialization function allows a remote peer to trigger a single-byte out-of-bounds write by sending crafted SIP requests to a proxy, SBC, or B2BUA that parses and re-serializes messages using the PJSIP library. The vulnerable function `pjsip_generic_array_hdr_print()` in `sip_msg.c` omitted bounds checking before writing the colon and space characters that follow generic array header names (Allow, Require, Supported, Unsupported), resulting in CWE-193 off-by-one writes at exact buffer boundaries. No public exploit has been identified at time of analysis; the vendor explicitly states that code execution and information disclosure have not been demonstrated, and pool-based allocator slack typically absorbs the errant byte harmlessly.
Out-of-bounds read in PJSIP pjproject 2.16 and earlier exposes SIP endpoints to remote crash and limited memory integrity corruption via a malformed Content-ID URI in a SIP multipart message body. The vulnerability requires no authentication and no user interaction, making it automatable per SSVC analysis, though exploitation probability remains very low (EPSS 0.04%, 11th percentile) with no public exploit or active exploitation recorded. The primary risk is availability - a crafted SIP multipart packet can crash the parsing component - with a secondary low-severity integrity signal per the CVSS 4.0 vector (VI:L); confidentiality impact is assessed as none.
Heap out-of-bounds read in PJSIP's VP9 RTP unpacketizer allows remote attackers to read memory beyond allocated buffer boundaries by sending crafted VP9 Scalability Structure data, potentially disclosing sensitive information. PJSIP versions prior to 2.17 are affected. The vulnerability requires network access but no authentication, authentication complexity, or user interaction, with CVSS score of 6.9 indicating moderate severity driven by availability impact. Vendor-released patch available in version 2.17.