Executive brief
PJSIP is a multimedia communication library used in voice and video applications. When a non-default interoperability feature is enabled, the library fails to properly validate payload-type numbers in remote SDP offers, allowing an attacker to trigger out-of-bounds memory access. This can cause memory corruption and service denial, affecting applications that depend on PJSIP for real-time communications.
Technical details
The vulnerability is an out-of-bounds read/write (CWE-129, CWE-787) in the assign_pt_and_update_map() function within pjmedia/src/pjmedia/sdp_neg.c. The function parses payload-type numbers from remote SDP attributes (a=rtpmap, a=fmtp, RED references, and media format lists) and uses these untrusted values to index fixed-size arrays covering only payload types 96–127, without sufficient bounds validation. A crafted remote SDP with out-of-range payload numbers (e.g., "a=rtpmap:65535") causes memory access outside intended table boundaries. The attack requires no authentication and is network-accessible; it is only triggered when the PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP compile-time feature is explicitly enabled (disabled by default). The practical impact is memory corruption and denial of service; code execution is not demonstrated. A fix is available in commit 673b978, which adds bounds checking via an is_dynamic_pt() helper.
Affected products
- PJSIP pjproject <= 2.17
Timeline
- 2026-06-17: disclosed
- 2026-09-04: patched: patch available as commit 673b978