Stack-based buffer overflow in pjsip - CVE-2026-25994
Published: April 14, 2026 / Updated: April 17, 2026
Vulnerability identifier: #VU125904
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-25994
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service or execute arbitrary code.
The vulnerability exists due to stack-based buffer overflow in PJNATH ICE Session when processing credentials with excessively long usernames. A remote attacker can send crafted credentials with an excessively long username to cause a denial of service or execute arbitrary code.
This issue affects applications that use ICE.
Affected software
pjsip
Ubuntu
Asterisk Open Source
Certified Asterisk
pjproject (Ubuntu package)
Ubuntu
Asterisk Open Source
Certified Asterisk
pjproject (Ubuntu package)
How to mitigate CVE-2026-25994
Install security update from vendor's website.
pjsip - update to 2.17
Asterisk Open Source - addressed in versions 20.19.0, 21.12.2, 22.9.0, 23.3.0
Certified Asterisk - addressed in versions 20.7-cert10, 22.8-cert2
pjproject (Ubuntu package) - addressed in versions 2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1, 2.7.2~dfsg-1ubuntu0.1~esm1
Asterisk Open Source - addressed in versions 20.19.0, 21.12.2, 22.9.0, 23.3.0
Certified Asterisk - addressed in versions 20.7-cert10, 22.8-cert2
pjproject (Ubuntu package) - addressed in versions 2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1, 2.7.2~dfsg-1ubuntu0.1~esm1