# CVE-2026-57166: PJSIP stack buffer overflow in telnet CLI

Source: https://junglewise.ai/threats/cve-2026-57166-pjsip-stack-buffer-overflow-in-telnet-cli  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-57166 · Severity: medium · CVSS 5.3 · Published 2026-09-04

PJSIP is a multimedia communication library used in VoIP and real-time communication applications. The telnet CLI interface—an unauthenticated administration console—contains multiple stack buffer overflow vulnerabilities triggered by overly long command lines. An unauthenticated attacker with network access to the telnet CLI can crash the application or potentially execute arbitrary code, though the fixed vulnerabilities demonstrate the impact was primarily denial-of-service through application termination.

Technologies: [PJSIP Pjproject](https://junglewise.ai/threats/technologies/pjproject), [Teluu Pjsip](https://junglewise.ai/threats/technologies/pjsip). Vendors: [PJSIP](https://junglewise.ai/threats/vendors/pjsip), [Teluu](https://junglewise.ai/threats/vendors/teluu).

## Quick answers

**Is CVE-2026-57166 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57166 being exploited in the wild.

**How severe is CVE-2026-57166?** Medium severity, with a CVSS score of 5.3, published 4 September 2026.

**Which products and versions are affected?** PJSIP Pjproject 2.17 and prior.

**Is there a fix for CVE-2026-57166?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57166 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-57166?** Check whether you run PJSIP Pjproject or Teluu Pjsip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stack-based buffer overflow (CWE-121) affecting the PJLIB-UTIL telnet CLI component in PJSIP. Three separate code paths in cli_telnet.c—send_err_arg(), send_ambi_arg(), and handle_tab()—write attacker-controlled data (bounded only by PJ_CLI_MAX_CMDBUF) into fixed-size stack buffers (ranging from 256 to 1028 bytes) using unchecked string concatenation functions like pj_strcat2(). The vulnerability requires the telnet CLI front-end to be enabled via pj_cli_telnet_create() or --cli-telnet-port, and is reachable without authentication from any network client able to reach the listening port. An attacker can trigger the overflow by sending an overly long command line through the telnet interface, leading to stack corruption and application crash. The patch (commit 4472a31) fixes the issue by streaming output in bounded chunks and clamping indices to prevent buffer overflows.

## Affected products

- PJSIP pjproject 2.17 and prior

## Timeline

- 2026-06-17: disclosed: Fix committed via commit 4472a31
- 2026-09-04: advisory: CVE-2026-57166 published

## References

- [https://github.com/pjsip/pjproject/commit/4472a31d77a7506ff175dad5abef490f4e31bed1](https://github.com/pjsip/pjproject/commit/4472a31d77a7506ff175dad5abef490f4e31bed1)
- [https://github.com/pjsip/pjproject/security/advisories/GHSA-9c8q-h38q-p85j](https://github.com/pjsip/pjproject/security/advisories/GHSA-9c8q-h38q-p85j)

## Related threats

- [PJSIP stack buffer overflow in telnet CLI history redraw](https://junglewise.ai/threats/cve-2026-57165-pjsip-stack-buffer-overflow-in-telnet-cli-history-redraw)
- [PJSIP heap buffer overflow in HTTP client](https://junglewise.ai/threats/cve-2026-57164-pjsip-heap-buffer-overflow-in-http-client)
- [PJSIP stack buffer overflow in GnuTLS TLS backend](https://junglewise.ai/threats/cve-2026-57163-pjsip-stack-buffer-overflow-in-gnutls-tls-backend)
- [PJSIP stack buffer overflow in SRTP/SDES SDP processing](https://junglewise.ai/threats/cve-2026-57162-pjsip-stack-buffer-overflow-in-srtp-sdes-sdp-processing)
- [PJSIP stack buffer overflow in Service-Route header processing](https://junglewise.ai/threats/cve-2026-57161-pjsip-stack-buffer-overflow-in-service-route-header-processing)