Out-of-bounds write in pjsip - #VU159272
Published: November 4, 2026
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by crashing the application.
The vulnerability exists due to an out-of-bounds write in the DTLS-SRTP transport's ssl_flush_wbio() function when draining a handshake flight larger than a single channel buffer. A remote attacker can send UDP traffic to the media port to initiate a DTLS handshake, causing the function to use the combined size of two channel buffers as the read limit and overwrite adjacent transport object fields to crash the application.
Exploitation requires a build with PJMEDIA_SRTP_HAS_DTLS=1 and PJMEDIA_MAX_MTU smaller than the handshake flight, approximately 700 bytes with the default EC certificate or 1400 bytes with an RSA certificate.