CVE-2026-57160: PJSIP buffer overflow in generic array header serialization

CVE-2026-57160 · Severity: medium · CVSS 5.3 · Published 2026-09-04

PJSIP is a free multimedia communication library used in VoIP and SIP-based telephony systems. A buffer overflow vulnerability in the library's message serialization function allows remote attackers to write one byte past the end of a buffer when processing certain SIP header types. While the impact is limited to a single-byte write with no demonstrated code execution risk, systems that parse and re-serialize incoming SIP requests—such as proxies, session border controllers, or back-to-back user agents—are vulnerable to denial-of-service or memory corruption attacks.

Technologies: PJSIP Pjproject, Teluu Pjsip. Vendors: PJSIP, Teluu.

Quick answers

Is CVE-2026-57160 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57160 being exploited in the wild.
How severe is CVE-2026-57160?
Medium severity, with a CVSS score of 5.3, published 4 September 2026.
Which products and versions are affected?
PJSIP Pjproject <= 2.17.
Is there a fix for CVE-2026-57160?
A patch was published on 2026: Fix available as commit d6a0e7f in master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57160 attacked?
It is attacked over the network.
Am I affected by CVE-2026-57160?
Check whether you run PJSIP Pjproject or Teluu Pjsip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a one-byte buffer overflow (off-by-one error, CWE-193) in pjsip_generic_array_hdr_print() within sip_msg.c. The function serializes SIP headers such as Allow, Require, Supported, and Unsupported by writing the header name followed by a colon and space delimiter. The vulnerable code used unchecked pointer increments to write the colon and space characters, which can exceed buffer boundaries under certain conditions when the output buffer has limited remaining space. The vulnerability is reachable in applications that parse and re-serialize incoming SIP messages—particularly SIP proxies, session border controllers (SBCs), and back-to-back user agents (B2BUAs)—where a remote peer can craft malicious SIP requests to trigger the overflow. While the single out-of-bounds write does not directly enable code execution or information disclosure in typical pool-based memory allocations, it can cause memory corruption or crashes. The fix (commit d6a0e7f) replaces the unchecked increments with boundary-checked character writes, matching the safe pattern used elsewhere in the file.

Affected products

  • PJSIP pjproject <= 2.17

Timeline

  • 2026-06-17: disclosed: GitHub Security Advisory GHSA-277r-3q2j-mxcw published
  • 2026: patched: Fix available as commit d6a0e7f in master branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.