Out-of-bounds read in pjsip - #VU155804
Published: October 15, 2026
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.
The vulnerability exists due to an out-of-bounds read in the PJSUA-LIB function pjsua_im_process_pager() in pjsua_im.c when processing incoming SIP MESSAGE requests. A remote attacker can send a specially crafted MESSAGE with an unusually long Content-Type header to disclose sensitive information or cause a denial of service.
Only applications that receive instant messages through the on_pager() or on_pager2() callback are affected, including all PJSUA2 applications. Stack memory may be exposed to remote parties if the application relays or echoes the content type. Exploitation does not require an active call.