A heap use‑after‑free flaw in PJSIP’s event subscription framework allows an attacker to trigger arbitrary code execution by sending a presence unsubscription request (SUBSCRIBE with Expires=0). The vulnerability resides in evsub.c and is catalogued as CWE‑416 and CWE‑825. Because memory is freed and then accessed, an attacker who can craft the unsubscription packet could manipulate program flow or crash the process, leading to potential denial of service or execution of malicious code on the host.

The affected product is PJSIP from the pjproject vendor. All releases prior to version 2.17 are vulnerable; version 2.17 and later contain the patch that protects against the heap use‑after‑free during presence subscription termination.

The CVSS score of 8.7 classifies this flaw as high severity. The EPSS score of less than 1% indicates a very low current exploit probability, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, if the affected library is exposed to network traffic or local users with sufficient privileges, the attack vector is likely remote or local depending on the deployment context. The low EPSS score should not diminish the urgency of remediation because the potential impact is severe.