Return of Stack Variable Address in pjsip - #VU156285
Published: October 21, 2026 / Updated: November 5, 2026
Vulnerability details
The vulnerability allows a remote attacker to cause an application to terminate or hang, or disclose stack memory through an outgoing Authorization header.
The vulnerability exists due to references to stack-allocated list nodes that outlive their scope in PJSUA2's DigestCredential::toPj() and DigestChallenge::toPj() functions when preparing parameters for a digest AKA response. A remote attacker can send a digest AKA challenge to trigger copying of the invalid other_param list in Endpoint::on_auth_create_aka_response_callback(), potentially causing a denial of service or disclosure of stack memory.
Exploitation is limited to PJSUA2 applications that use Digest AKA credentials (PJSIP_CRED_DATA_EXT_AKA), override Endpoint::onCredAuth() to compute the response, and add parameters to digestCredential.otherParam. These parameter values come from the application, not the remote server.