Vulnerability · Published Sep 4, 2026 · Assigned by GitHub_M
CVE-2026-57162PJSIP: Stack overflow parsing SDP a=crypto attributes
High 8.8
In plain English
A high-severity stack buffer overflow in pjproject from pjsip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Official description
PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer (sdes_encode_sdp() in transport_srtp_sdes.c). This affects applications with SRTP enabled (use_srtp optional or mandatory, using SDES keying). During media negotiation, the crypto attributes from the remote SDP are collected into a fixed-size array without bounding their number; a remote peer that includes an excessive number of a=crypto attributes in a single media description can write past the end of that array on the stack. This is reachable from an incoming SIP INVITE during offer/answer, before application-level authentication. Impact may range from unexpected application termination to control flow hijack/memory corruption. Applications that do not enable SRTP are not affected. This issue has been patched via commit a1b707c.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | asterisk | no fix listed | DEBIAN-CVE-2026-57162 |
| Ubuntu:22.04:LTS | asterisk | no fix listed | UBUNTU-CVE-2026-57162 |
| Ubuntu:24.04:LTS | asterisk | no fix listed | UBUNTU-CVE-2026-57162 |
| Ubuntu:26.04:LTS | asterisk | no fix listed | UBUNTU-CVE-2026-57162 |
| Ubuntu:26.10 | asterisk | no fix listed | UBUNTU-CVE-2026-57162 |
Affected products (as reported)
Weakness: CWE-121 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N