Quick answers
- Is CVE-2026-57159 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-57159 being exploited in the wild.
- How severe is CVE-2026-57159?
- High severity, with a CVSS score of 7.5, published 4 September 2026.
- Which products and versions are affected?
- PJSIP Pjproject <= 2.17.
- Is there a fix for CVE-2026-57159?
- A patch was published on 2026-09-04: patch available as commit 673b978 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-57159 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-57159?
- Check whether you run PJSIP Pjproject or Teluu Pjsip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an out-of-bounds read/write (CWE-129, CWE-787) in the assign_pt_and_update_map() function within pjmedia/src/pjmedia/sdp_neg.c. The function parses payload-type numbers from remote SDP attributes (a=rtpmap, a=fmtp, RED references, and media format lists) and uses these untrusted values to index fixed-size arrays covering only payload types 96–127, without sufficient bounds validation. A crafted remote SDP with out-of-range payload numbers (e.g., "a=rtpmap:65535") causes memory access outside intended table boundaries. The attack requires no authentication and is network-accessible; it is only triggered when the PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP compile-time feature is explicitly enabled (disabled by default). The practical impact is memory corruption and denial of service; code execution is not demonstrated. A fix is available in commit 673b978, which adds bounds checking via an is_dynamic_pt() helper.
Affected products
- PJSIP pjproject <= 2.17
Timeline
- 2026-06-17: disclosed
- 2026-09-04: patched: patch available as commit 673b978