Out-of-bounds read in pjsip - #VU159269
Published: November 4, 2026
Vulnerability identifier: #VU159269
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by crashing an application using PJSIP.
The vulnerability exists due to an out-of-bounds read in pjsip_get_dest_info() in pjsip/src/pjsip/sip_util.c when processing the first outgoing request within a dialog whose route set contains a non-SIP URI. A remote attacker can supply a non-SIP URI in a Record-Route header of a dialog-establishing request or response, causing the function to interpret it as a SIP URI and read beyond its bounds to crash the application.
Exploitation requires automatic switching to secure transport to be enabled, which is the default configuration. Event subscription dialogs are also affected.
Affected software
pjsip
Remediation
Install security update from vendor's website.
pjsip - update to 2.18