Executive brief
PJSIP is a multimedia communication library used in VoIP and real-time communication applications. The telnet CLI interface—an unauthenticated administration console—contains multiple stack buffer overflow vulnerabilities triggered by overly long command lines. An unauthenticated attacker with network access to the telnet CLI can crash the application or potentially execute arbitrary code, though the fixed vulnerabilities demonstrate the impact was primarily denial-of-service through application termination.
Technical details
The vulnerability is a stack-based buffer overflow (CWE-121) affecting the PJLIB-UTIL telnet CLI component in PJSIP. Three separate code paths in cli_telnet.c—send_err_arg(), send_ambi_arg(), and handle_tab()—write attacker-controlled data (bounded only by PJ_CLI_MAX_CMDBUF) into fixed-size stack buffers (ranging from 256 to 1028 bytes) using unchecked string concatenation functions like pj_strcat2(). The vulnerability requires the telnet CLI front-end to be enabled via pj_cli_telnet_create() or --cli-telnet-port, and is reachable without authentication from any network client able to reach the listening port. An attacker can trigger the overflow by sending an overly long command line through the telnet interface, leading to stack corruption and application crash. The patch (commit 4472a31) fixes the issue by streaming output in bounded chunks and clamping indices to prevent buffer overflows.
Affected products
- PJSIP pjproject 2.17 and prior
Timeline
- 2026-06-17: disclosed: Fix committed via commit 4472a31
- 2026-09-04: advisory: CVE-2026-57166 published