Use-after-free in pjsip - #VU155835
Published: October 15, 2026
Vulnerability identifier: #VU155835
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in pres_on_evsub_rx_notify() in presence.c and dlg_event_on_evsub_rx_notify() in dlg_event.c when processing a notification without a message body. A remote attacker can send a NOTIFY with a body followed by a NOTIFY without a body in the same subscription to cause a denial of service.
Exploitation requires the application to subscribe to presence or dialog events from the sending remote party or presence server.
Affected software
pjsip
Remediation
Install security update from vendor's website.
pjsip - update to 2.18