Out-of-bounds write in pjsip - #VU165883
Published: November 11, 2026
Vulnerability identifier: #VU165883
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to corrupt heap memory and cause a denial of service in PJSIP applications.
The vulnerability exists due to an out-of-bounds write in the audio stream encoding buffer when remote SDP specifies a packet duration exceeding its 200 ms capacity and G.729 or AMR encoders fail to check output bounds. A remote attacker can negotiate either codec with an excessive SDP ptime value, without sending media, to trigger writes of the application's encoded audio beyond the buffer and crash the application.
Affected software
pjsip
Remediation
Install security update from vendor's website.
pjsip - update to 2.18