The vulnerability is a heap buffer overflow in the PJNATH ICE Session of the PJSIP library. When the library processes credentials that contain an excessively long username, a memory overwrite occurs. If exploited, this could allow a malicious actor to inject code or corrupt data, potentially leading to arbitrary code execution or service disruption. The flaw directly compromises the integrity of the process handling the credentials and, if successful, may also expose sensitive information.

The issue affects the PJSIP (PJProject) library, versions 2.16 and earlier. Any application that incorporates PJProject and uses ICE to process authentication credentials is at risk. Typical deployments include VoIP servers, SIP proxy or media transport services that rely on the open-source library.

The CVSS score is 8.1, indicating high severity. The EPSS score is less than 1%, showing a low probability of exploitation in the wild at present. The vulnerability is not listed in CISA’s KEV catalog. Based on how the bug is triggered—a crafted long username in an ICE credential—the likely attack vector is remote, where an attacker sends a specially crafted SIP packet or credential to a vulnerable service.