Executive brief
PJSIP is a free multimedia communication library used in VoIP and SIP-based telephony systems. A buffer overflow vulnerability in the library's message serialization function allows remote attackers to write one byte past the end of a buffer when processing certain SIP header types. While the impact is limited to a single-byte write with no demonstrated code execution risk, systems that parse and re-serialize incoming SIP requests—such as proxies, session border controllers, or back-to-back user agents—are vulnerable to denial-of-service or memory corruption attacks.
Technical details
This is a one-byte buffer overflow (off-by-one error, CWE-193) in pjsip_generic_array_hdr_print() within sip_msg.c. The function serializes SIP headers such as Allow, Require, Supported, and Unsupported by writing the header name followed by a colon and space delimiter. The vulnerable code used unchecked pointer increments to write the colon and space characters, which can exceed buffer boundaries under certain conditions when the output buffer has limited remaining space. The vulnerability is reachable in applications that parse and re-serialize incoming SIP messages—particularly SIP proxies, session border controllers (SBCs), and back-to-back user agents (B2BUAs)—where a remote peer can craft malicious SIP requests to trigger the overflow. While the single out-of-bounds write does not directly enable code execution or information disclosure in typical pool-based memory allocations, it can cause memory corruption or crashes. The fix (commit d6a0e7f) replaces the unchecked increments with boundary-checked character writes, matching the safe pattern used elsewhere in the file.
Affected products
- PJSIP pjproject <= 2.17
Timeline
- 2026-06-17: disclosed: GitHub Security Advisory GHSA-277r-3q2j-mxcw published
- 2026: patched: Fix available as commit d6a0e7f in master branch