Executive brief
PJSIP is an open-source multimedia communication library used in VoIP and real-time communication applications. A stack buffer overflow in its optional telnet CLI front-end can occur when recalling command history, potentially crashing applications that have this feature enabled. An attacker would need unauthenticated access to the telnet CLI to trigger this, though the practical impact is limited since the interface already allows arbitrary CLI commands.
Technical details
A stack buffer overflow exists in the handle_up_down() function in cli_telnet.c within PJLIB-UTIL, the utility library component of PJSIP. The vulnerability occurs when redrawing the command line during history recall: the function accumulates cur_pos + 2*rcmd->len + history->slen bytes into a fixed-size PJ_CLI_MAX_CMDBUF stack buffer without proper bounds checking. An unauthenticated attacker with access to the telnet CLI can craft a history entry that triggers the overflow, leading to application termination or potential code execution. The patch (commit 628b716) sizes the buffer for worst-case scenarios, clamps each term to PJ_CLI_MAX_CMDBUF, and replaces an unchecked pj_strcat with bounded pj_memcpy. This issue only affects applications that explicitly enable the telnet CLI front-end.
Affected products
- PJSIP PJSIP 2.17 or lower
Timeline
- 2026-09-04: disclosed
- 2026-06-17: patched: Patch available as commit 628b716 in master branch