SB2026080538 - Multiple vulnerabilities in pjsip

Security Bulletin ID SB2026080538

CSH Severity

High

Patch available

YES

Number of vulnerabilities 40

Exploitation vector Remote access

Highest impact Denial of service

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 40 vulnerabilities.

1) Return of Stack Variable Address (CVE-ID: N/A)

CWE-ID: CWE-562 - Return of Stack Variable Address

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service or disclose stack memory.

The vulnerability exists due to references to out-of-scope stack variables in the PJSUA2 DigestCredential::toPj() and DigestChallenge::toPj() functions when constructing the other_param list for digest AKA authentication. A remote attacker can initiate a digest AKA challenge exchange with an affected application to potentially trigger reads of invalid stack memory when Endpoint::on_auth_create_aka_response_callback() copies the list, resulting in application termination, a hang, or stack memory disclosure in the outgoing Authorization header.

Affected applications must use Digest AKA credentials (PJSIP_CRED_DATA_EXT_AKA), override Endpoint::onCredAuth() to compute the response, and add parameters to digestCredential.otherParam. These parameter contents come from the application, not the remote server. Applications using the PJSUA C API are not affected.

2) Division by zero (CVE-ID: N/A)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by crashing the application.

The vulnerability exists due to division by zero in the video conference bridge when five or more video sources are connected to one sink and sources receive empty destination rectangles that are subsequently used as divisors. A remote attacker can supply video as a connected conference participant under this condition to trigger division by zero and cause an application crash.

3) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by crashing an application.

The vulnerability exists due to a use-after-free in pjsua_acc_send_response() in pjsip/src/pjsua-lib/pjsua_acc.c when an application sends a deferred MESSAGE response after the associated transaction has been destroyed. A remote attacker can send a MESSAGE request over TCP or TLS and close the connection before the application responds to cause access to the freed transaction and crash the application.

The affected deferred-response behavior requires auto_repond_sip_message to be disabled; this option is enabled by default.

4) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by crashing an application that renders incoming video.

The vulnerability exists due to failure to resize the frame buffer in the PJMEDIA video port when processing a video source format change that increases the frame size. A remote attacker can increase the resolution of transmitted video to make the converter read beyond the existing frame buffer and potentially crash the application.

pjsua and PJSUA2 are not affected in their default configuration because they connect renderers through a passive video port.

5) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by crashing an application using PJSIP.

The vulnerability exists due to an out-of-bounds read in pjsip_get_dest_info() in pjsip/src/pjsip/sip_util.c when processing the first outgoing request within a dialog whose route set contains a non-SIP URI. A remote attacker can supply a non-SIP URI in a Record-Route header of a dialog-establishing request or response, causing the function to interpret it as a SIP URI and read beyond its bounds to crash the application.

Exploitation requires automatic switching to secure transport to be enabled, which is the default configuration. Event subscription dialogs are also affected.

6) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by crashing the application.

The vulnerability exists due to an out-of-bounds write in the DTLS-SRTP transport's ssl_flush_wbio() function when draining a handshake flight larger than a single channel buffer. A remote attacker can send UDP traffic to the media port to initiate a DTLS handshake, causing the function to use the combined size of two channel buffers as the read limit and overwrite adjacent transport object fields to crash the application.

Exploitation requires a build with PJMEDIA_SRTP_HAS_DTLS=1 and PJMEDIA_MAX_MTU smaller than the handshake flight, approximately 700 bytes with the default EC certificate or 1400 bytes with an RSA certificate.

7) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt heap memory and cause a denial of service.

The vulnerability exists due to missing buffer-capacity checks in the audio switchboard, stream frame collection, and passthrough encoder when appending encoded audio frames. A remote attacker can specify a packet time exceeding the receiving buffer's capacity in SDP and send crafted RTP payloads during a call using a passthrough codec to write attacker-controlled data beyond a heap buffer and crash the application.

Only builds with both PJMEDIA_CONF_USE_SWITCH_BOARD=1 and PJMEDIA_HAS_PASSTHROUGH_CODECS=1 are affected.

8) Use of Uninitialized Variable (CVE-ID: N/A)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially disclose sensitive memory contents.

The vulnerability exists due to use of uninitialised format entries in the SDP negotiator's match_offer() function in pjmedia/src/pjmedia/sdp_neg.c when processing an offer that repeats a media format. A remote attacker can send a single INVITE containing duplicate formats to produce excess answer entries, triggering an assertion failure in assertion-enabled builds or reads of uninitialised memory in release builds that can crash the application or expose stale memory contents in the SDP answer.

Applications must have text media with redundancy (RED) enabled; this is the default in pjsua-lib and PJSUA2.

9) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by crashing an application using PJSIP.

The vulnerability exists due to an out-of-bounds write in the PJMEDIA jitter buffer when an empty jitter buffer zero-fills a codec frame larger than the audio stream's decoding buffer. A remote attacker can place a call that the application accepts and that negotiates an enabled codec with an oversized frame, such as L16/44100/2, then send no media to trigger a write past the decoding buffer into the stream's encoder state and crash the application.

10) Return of Stack Variable Address (CVE-ID: N/A)

CWE-ID: CWE-562 - Return of Stack Variable Address

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an application to terminate or hang, or disclose stack memory through an outgoing Authorization header.

The vulnerability exists due to references to stack-allocated list nodes that outlive their scope in PJSUA2's DigestCredential::toPj() and DigestChallenge::toPj() functions when preparing parameters for a digest AKA response. A remote attacker can send a digest AKA challenge to trigger copying of the invalid other_param list in Endpoint::on_auth_create_aka_response_callback(), potentially causing a denial of service or disclosure of stack memory.

Exploitation is limited to PJSUA2 applications that use Digest AKA credentials (PJSIP_CRED_DATA_EXT_AKA), override Endpoint::onCredAuth() to compute the response, and add parameters to digestCredential.otherParam. These parameter values come from the application, not the remote server.

11) Stack-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by crashing the application.

The vulnerability exists due to a stack-based buffer overflow in update_render_state() in pjmedia/src/pjmedia/vid_conf.c when rebuilding the render state for a sink connected to five or more video sources. A remote attacker can change the frame size of a connected video source to trigger writes beyond two four-entry stack arrays and cause an application crash.

12) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by crashing an application receiving Opus audio.

The vulnerability exists due to an out-of-bounds write in codec_recover() in pjmedia/src/pjmedia-codec/opus.c when packet loss concealment zero-fills a frame using its unclamped size rather than the caller's buffer size. A remote attacker can send packets that determine the decoder's frame duration to trigger a concealment frame larger than the stream buffer, causing an assertion failure or a heap overflow with zero bytes and crashing the application.

Affected applications must use Opus in the receiving direction with packet loss concealment enabled, which is the default. The zero-fill path is used when there is no previous packet to conceal from.

13) Improper Certificate Validation (CVE-ID: N/A)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass TLS client certificate requirements.

The vulnerability exists due to improper certificate validation in PJSIP's OpenSSL SSL socket backend when resuming sessions, because verification failures are recorded only during full handshakes and resumed sessions report a clean status. A remote attacker can present an untrusted certificate, obtain a session on the refused connection, and resume it to bypass client certificate enforcement, while remaining subject to application-level authentication checks.

14) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt heap memory and cause a denial of service in PJSIP applications.

The vulnerability exists due to an out-of-bounds write in the audio stream encoding buffer when remote SDP specifies a packet duration exceeding its 200 ms capacity and G.729 or AMR encoders fail to check output bounds. A remote attacker can negotiate either codec with an excessive SDP ptime value, without sending media, to trigger writes of the application's encoded audio beyond the buffer and crash the application.

15) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to expose uninitialised stack memory through locally played UWB 24 kbit/s audio or cause memory-checking builds to abort.

The vulnerability exists due to out-of-bounds reads from unchecked power indices and incomplete coefficient initialisation in the bundled G.722.1 decoder when processing malformed frames. A remote attacker can send a single crafted RTP packet during a call negotiating G.722.1 to trigger these effects, without memory contents being returned to the peer.

16) Stack-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and potentially corrupt memory in applications enabling the telnet CLI.

The vulnerability exists due to stack-based buffer overflows from unchecked string operations and an assertion failure in the pjlib-util CLI when constructing command keys, prompts, or hints and handling excessive completion candidates. A remote attacker can press TAB on a command exceeding the hint limit to abort assertion-enabled builds, or trigger buffer overflows under non-default command trees or application-supplied configuration to corrupt memory.

17) Integer underflow (CVE-ID: N/A)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to abort the application process and cause a denial of service.

The vulnerability exists due to integer underflow in pjsua-lib's SIP INFO DTMF parser when incorrect body-length handling produces a negative remaining length with assertions enabled and DTMF callbacks configured. A remote attacker can send a single INFO request containing an improperly terminated application/dtmf-relay body during an established call to trigger an assertion failure and terminate the process.

18) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by crashing PJSUA2 applications built with assertions enabled.

The vulnerability exists due to a reachable assertion caused by a missing recheck of the cloned INVITE pointer in PJSUA2 Endpoint::on_incoming_call() when Account::onIncomingCall() immediately disconnects the call. A remote attacker can send INVITE requests that the application rejects within the callback after a provisional response to trigger a NULL-pointer assertion and abort the process.

19) Reachable assertion (CVE-ID: N/A)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by aborting applications using the PJSIP transaction layer.

The vulnerability exists due to a reachable assertion in the INVITE server transaction handler when requests with mismatched request-line and CSeq methods are matched to acknowledged INVITE transactions with assertions enabled. A remote attacker can send crafted requests whose Via branch and CSeq method select such a transaction to trigger the assertion and terminate the process.

20) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash applications using pjsua-lib or PJSUA2, causing a denial of service.

The vulnerability exists due to a null pointer dereference in pjsua-lib's SDP offer handling when a disabled media line lacks connection information at both media and session levels. A remote attacker can send a crafted INVITE to an application accepting incoming calls with a configured account, or a re-INVITE or UPDATE during an established call, to crash the process.

21) Improper validation of certificate with host mismatch (CVE-ID: N/A)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to impersonate a different host and observe or modify SIP signaling.

The vulnerability exists due to improper certificate common name extraction in the TLS backend certificate subject parsers when handling a peer TLS certificate during hostname verification. A remote attacker can present a certificate containing a CN= marker in an unrelated subject field to impersonate a different host and observe or modify SIP signaling.

Only TLS/SIPS transports with verify_server or verify_client set to PJ_TRUE are affected.

22) Uncontrolled Recursion (CVE-ID: N/A)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the pj_xml_parse() XML parser when parsing deeply nested XML documents in incoming SIP request bodies. A remote attacker can send a specially crafted SIP request with a deeply nested XML body to cause a denial of service.

The issue is reachable through XML bodies used by the presence/PIDF, dialog-info, and message-composition event packages, and production builds are affected because the existing recursion guard is only effective in debug builds.

23) Authentication Bypass by Spoofing (CVE-ID: N/A)

CWE-ID: CWE-290 - Authentication Bypass by Spoofing

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to spoof DNS responses and poison the DNS cache.

The vulnerability exists due to improper origin validation and use of insufficiently random values in the asynchronous DNS resolver when processing incoming DNS responses for pending queries. A remote attacker can send a forged DNS response to spoof DNS responses and poison the DNS cache.

A successful attack can poison SIP-related DNS lookups and redirect SIP signaling to an attacker-controlled host.

24) Algorithm Downgrade (CVE-ID: N/A)

CWE-ID: CWE-757 - Selection of Less-Secure Algorithm During Negotiat

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to downgrade subsequent in-dialog requests to plaintext.

The vulnerability exists due to selection of less-secure transport during negotiation in the dialog layer target refresh handling in pjsip_dlg_on_rx_request() and pjsip_dlg_on_rx_response() in sip_dialog.c when processing a Contact URI from an in-dialog target refresh. A remote attacker can supply a non-sips Contact to downgrade subsequent in-dialog requests to plaintext.

Only applications using SIPS-secured dialogs are affected.

25) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the UPnP IGD client's download_igd_xml() function when processing a device description containing an empty serviceType element. A remote attacker can reply to an SSDP M-SEARCH request with a crafted device description to cause a denial of service.

UPnP support must be built in and explicitly enabled for the vulnerable code path to be reachable.

26) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause the application to adopt a hostile IGD as its primary gateway.

The vulnerability exists due to a use-after-free in the UPnP IGD client's action_get_external_ip() function when processing a SOAP response containing an invalid NewExternalIPAddress value. A remote attacker can provide a crafted SOAP response to cause the application to adopt a hostile IGD as its primary gateway.

UPnP support must be built in and explicitly enabled for the vulnerable code path to be reachable.

27) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the UPnP IGD client's action_get_external_ip() function when parsing a nonnumeric NewExternalIPAddress value from a SOAP response. A remote attacker can provide an attacker-chosen hostname as the address value to stall a libupnp worker thread during name resolution and cause a denial of service.

UPnP support must be built in and explicitly enabled for the vulnerable code path to be reachable.

28) Unchecked Return Value (CVE-ID: N/A)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to unchecked return values in pjpidf_tuple_get_id() when parsing a malformed PIDF presence body containing a tuple without an id attribute. A remote user can send a malformed presence NOTIFY to cause a denial of service.

The sender must occupy the presentity or presence-server side of a presence subscription established by the application. Builds compiled with NDEBUG crash, while builds with assertions enabled abort.

29) Unchecked Return Value (CVE-ID: N/A)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to unchecked return values in pjpidf_tuple_get_status() when parsing a malformed PIDF presence body containing a tuple without a status child element. A remote user can send a malformed presence NOTIFY to cause a denial of service.

The sender must occupy the presentity or presence-server side of a presence subscription established by the application. Exploitation affects builds with assertions enabled, which is the default configuration.

30) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in calculate_response_expiration() in the SIP registration client when processing a 2xx response to an outgoing REGISTER containing a wildcard Contact header. A remote attacker can send a crafted 2xx response containing a wildcard Contact header to cause a denial of service.

The affected registration-client path is enabled by default.

31) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denialo f service (DoS) attack.

The vulnerability exists due to a boundary error in pjmedia_h263_unpacketize() function. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and cause a denial of service condition on the target system.

32) Improper validation of certificate with host mismatch (CVE-ID: N/A)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to impersonate a different host and observe or modify SIP signaling.

The vulnerability exists due to improper validation of a certificate with a host mismatch in on_connect_complete() in the TLS transport when comparing a requested host name against certificate identities. A remote attacker can present a certificate whose SubjectAltName does not match the requested host name but whose Common Name does to impersonate a different host and observe or modify SIP signaling.

Only TLS/SIPS transports with verify_server or verify_client set to PJ_TRUE are affected.

33) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the PJSUA-LIB function pjsua_im_process_pager() in pjsua_im.c when processing incoming SIP MESSAGE requests. A remote attacker can send a specially crafted MESSAGE with an unusually long Content-Type header to disclose sensitive information or cause a denial of service.

Only applications that receive instant messages through the on_pager() or on_pager2() callback are affected, including all PJSUA2 applications. Stack memory may be exposed to remote parties if the application relays or echoes the content type. Exploitation does not require an active call.

34) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory or cause a denial of service.

The vulnerability exists due to use-after-free in the PJLIB-UTIL HTTP client functions http_on_data_read() and restart_req_with_auth() when an application destroys a request from its callbacks and the client continues using it. A remote attacker can return an HTTP 401 or 407 response that triggers an authenticated retry which fails to start to corrupt memory or cause a denial of service.

The server-response attack requires configured authentication credentials. An on-path adversary can also trigger this scenario over a plain HTTP connection. Only applications using the pj_http_req_* API directly are affected; PJSUA and PJSUA2 do not use this HTTP client.

35) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in dataconn_on_data_read() in pjnath/src/pjnath/turn_sock.c when processing received data on a TURN TCP data connection. A remote attacker can trigger a ConnectionBind error response through a controlled TURN server or an on-path position on the data connection to cause a denial of service.

Only applications using TURN TCP allocations with TCP peer connections under RFC 6062, with peer_conn_type set to PJ_TURN_TP_TCP, are affected. PJSUA/PJSUA2 do not enable this functionality, and allocations with UDP peer connections are not affected.

36) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the pj_ice_sess_on_rx_pkt() and pj_ice_sess_send_data() functions in ice_session.c when an ICE session is restarted while application data is being received. A remote attacker can restart ICE during a call, for example by sending a re-INVITE with new ICE credentials while media is being received, to cause a denial of service.

Only applications that use ICE are affected, including PJSUA-LIB and PJSUA2 applications with ICE enabled for media.

37) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in pres_on_evsub_rx_notify() in presence.c and dlg_event_on_evsub_rx_notify() in dlg_event.c when processing a notification without a message body. A remote attacker can send a NOTIFY with a body followed by a NOTIFY without a body in the same subscription to cause a denial of service.

Exploitation requires the application to subscribe to presence or dialog events from the sending remote party or presence server.

38) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose application memory or cause a denial of service.

The vulnerability exists due to use-after-free in the PJSUA2 callbacks in endpoint.cpp when returning application-supplied values to PJSUA-LIB. A remote attacker can send an INVITE with a Replaces header, a REFER, or a SUBSCRIBE to disclose application memory or cause a denial of service.

Exploitation requires an application that customizes the affected callback values, such as response reasons, response headers and bodies, or SRTP crypto keys, or sets a custom Call-ID in a call setting. Applications using the PJSUA-LIB C API directly are not affected.

39) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially disclose application memory or cause a denial of service.

The vulnerability exists due to use-after-free in the PJSIP SIP TCP and TLS transport functions tcp_create() and tls_create() when an application destroys a listener with a published address while connections created by that listener remain open. A remote attacker can interact with a surviving connection to potentially receive application memory through references to freed listener data or cause unexpected application termination.

40) Race condition (CVE-ID: N/A)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and corrupt DNS query results or cached records.

The vulnerability exists due to a race condition involving a shared response buffer in the DNS resolver's on_read_complete() function in pjlib-util/src/pjlib-util/resolver.c when processing responses concurrently on IPv4 and IPv6 sockets. A remote attacker can trigger overlapping DNS responses to overwrite a parsed response while it is being delivered to query callbacks or saved to the cache, potentially causing an invalid memory read, a crash, or delivery or caching of records from another, unvalidated response.

Affected applications must be built with PJ_HAS_IPV6 enabled and poll the resolver ioqueue from more than one thread.

Remediation

Install update from vendor's website.

SB2026080538 - Multiple vulnerabilities in pjsip

Breakdown by Severity

Description

Remediation

References

Please verify you're human