High 8.8Published Sep 4, 2026

CVE-2026-57162PJSIP: Stack overflow parsing SDP a=crypto attributes

Updated under an hour ago (2026-10-19 07:00 UTC)

Does this affect you?

It affects pjsip pjproject and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for pjsip pjproject

Exploited in the last 30 days

PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer (sdes_encode_sdp() in transport_srtp_sdes.c). This affects applications with SRTP enabled (use_srtp optional or mandatory, using SDES keying). During media negotiation, the crypto attributes from the remote SDP are collected into a fixed-size array without bounding their number; a remote peer that includes an excessive number of a=crypto attributes in a single media description can write past the end of that array on the stack. This is reachable from an incoming SIP INVITE during offer/answer, before application-level authentication. Impact may range from unexpected application termination to control flow hijack/memory corruption. Applications that do not enable SRTP are not affected. This issue has been patched via commit a1b707c.

CVSS: 8.8 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-121
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Sep 4, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

pjsip pjproject pjsip:pjproject (from the name)	before a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9	CNA record
teluu pjsip teluu:pjsip	through 2.17	NVD

References

https://github.com/pjsip/pjproject/security/advisories/GHSA-m9g3-jcj8-qjfmx-refsource-confirm, patch, vendor-advisory
https://github.com/pjsip/pjproject/commit/a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9x-refsource-misc, patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.