Return of Stack Variable Address in pjsip - #VU159267
Published: November 4, 2026 / Updated: November 5, 2026
Vulnerability details
The vulnerability allows a remote attacker to potentially cause a denial of service or disclose stack memory.
The vulnerability exists due to references to out-of-scope stack variables in the PJSUA2 DigestCredential::toPj() and DigestChallenge::toPj() functions when constructing the other_param list for digest AKA authentication. A remote attacker can initiate a digest AKA challenge exchange with an affected application to potentially trigger reads of invalid stack memory when Endpoint::on_auth_create_aka_response_callback() copies the list, resulting in application termination, a hang, or stack memory disclosure in the outgoing Authorization header.
Affected applications must use Digest AKA credentials (PJSIP_CRED_DATA_EXT_AKA), override Endpoint::onCredAuth() to compute the response, and add parameters to digestCredential.otherParam. These parameter contents come from the application, not the remote server. Applications using the PJSUA C API are not affected.