Is CVE-2026-57162 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57162 being exploited in the wild.

How severe is CVE-2026-57162?

Critical severity, with a CVSS score of 9.1, published 4 September 2026.

Which products and versions are affected?

PJSIP Pjproject 2.17 and earlier.

Is there a fix for CVE-2026-57162?

A patch was published on 2026-06-17: Patch available via commit a1b707c in master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57162 attacked?

It is attacked over the network.

Am I affected by CVE-2026-57162?

Check whether you run PJSIP Pjproject or Teluu Pjsip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57162: PJSIP stack buffer overflow in SRTP/SDES SDP processing

CVE-2026-57162 · Severity: critical · CVSS 9.1 · Published 2026-09-04

PJSIP is an open-source communications library used in VoIP and multimedia applications. A stack buffer overflow in the SRTP encryption key negotiation component allows a remote attacker to send a specially crafted SIP message that crashes the application or potentially executes arbitrary code before any authentication occurs. Applications without SRTP enabled are not affected.

Technologies: PJSIP Pjproject, Teluu Pjsip. Vendors: PJSIP, Teluu.

Quick answers

Is CVE-2026-57162 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57162 being exploited in the wild.
How severe is CVE-2026-57162?: Critical severity, with a CVSS score of 9.1, published 4 September 2026.
Which products and versions are affected?: PJSIP Pjproject 2.17 and earlier.
Is there a fix for CVE-2026-57162?: A patch was published on 2026-06-17: Patch available via commit a1b707c in master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57162 attacked?: It is attacked over the network.
Am I affected by CVE-2026-57162?: Check whether you run PJSIP Pjproject or Teluu Pjsip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow (CWE-121) exists in sdes_encode_sdp() in transport_srtp_sdes.c when parsing SDP a=crypto attributes during media negotiation. The function writes parsed crypto tags into a fixed 64-entry array without validating the count, while the SDP parser allows up to 68 attributes per media description. A remote peer can send an SDP with more than 64 a=crypto attributes in a single media description to overflow the stack array. The vulnerability is reachable from an unauthenticated incoming SIP INVITE during offer/answer negotiation, requiring only that the application has SRTP enabled (use_srtp set to optional or mandatory with SDES keying). Exploitation may cause denial of service through application crash or potentially memory corruption leading to code execution. The patch (commit a1b707c) adds bounds checking to reject SDPs exceeding the array capacity.

Affected products

PJSIP PJPROJECT 2.17 and earlier

Timeline

2026-06-17: disclosed: GitHub Security Advisory GHSA-m9g3-jcj8-qjfm published
2026-06-17: patched: Patch available via commit a1b707c in master branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.