Vulnerability · Published Mar 6, 2026 · Assigned by GitHub_M
CVE-2026-29068PJSIP: Stack buffer overflow in Opus codec parser
High 8.7
In plain English
A high-severity stack buffer overflow in pjproject from pjsip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, there is a stack buffer overflow vulnerability when pjmedia-codec parses an RTP payload contain more frames than the caller-provided frames can hold. This issue has been patched in version 2.17.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | pjproject | 2.17-r0 | ALPINE-CVE-2026-29068 |
| Debian:14 | asterisk | 1:22.10.0+dfsg+~cs6.17.60671434-1 | DEBIAN-CVE-2026-29068 |
Affected products (as reported)
Weakness: CWE-121 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N