Executive brief
PJSIP is an open-source multimedia communication library used for VoIP and real-time communication applications. A flaw in its GnuTLS backend allows an attacker to trigger a stack buffer overflow by presenting a crafted TLS certificate during the initial handshake, before any application-level authentication occurs. This can lead to application crashes or, in worst-case scenarios, arbitrary code execution.
Technical details
The vulnerability is a stack-based buffer overflow (CWE-121) in the tls_cert_get_info() function within ssl_sock_gtls.c. The root cause is an incorrect buffer-size value (512 bytes) passed to gnutls_x509_crt_get_subject_alt_name() when the actual output buffer is only 256 bytes, causing an oversized SubjectAltName entry to overflow the stack. The attack is network-triggered during TLS handshake—a malicious server can attack a connecting client, or a malicious client can attack a server requesting certificates—requiring no prior authentication. Exploitation can result in denial of service or memory corruption leading to code execution. Only GnuTLS-compiled builds (--with-gnutls) are affected; OpenSSL and Apple SecureTransport/Network.framework backends are not vulnerable. The fix is available via commit c4a151a, which corrects the buffer-size calculation to sizeof(out) - 1 on every iteration.
Affected products
- PJSIP PJPROJECT 2.17 and earlier
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: commit c4a151a