The vulnerability is a heap use‑after‑free race condition in the ICE (Interactive Connectivity Establishment) session handling of PJSIP. The bug can allow a crafted input that frees memory still referenced by a callback, creating a dangling pointer. From this state an attacker could execute arbitrary code or crash the process, potentially affecting confidentiality, integrity, or availability of the communication data. The attack vector is inferred to arise when an application using PJSIP processes ICE traffic; it is unclear whether the vulnerability requires local or remote interaction, but any component that initiates or receives ICE messages could be the entry point.

Affected products include the PJSIP pjproject library version 2.16 and earlier. The issue is present in the ICE session code of this library and applies to any build of pjproject used for network communication. The vendor, PJSIP, states that the functionality is fixed in version 2.17 and later.

The CVSS score of 8 indicates high severity. The EPSS metric is below 1%, which suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Despite the low observed likelihood, the nature of the bug—allowing arbitrary code execution—warrants prompt action, especially if an attacker can influence ICE traffic, potentially from a remote source or a compromised local process.