PJSIP is a free and open source multimedia communication library written in C. A heap‑based buffer overflow exists in the DNS parser’s name‑length handler, which can allow an attacker to trigger arbitrary code execution by sending a specially crafted DNS query. The vulnerability is marked as CWE‑122 and can lead to loss of confidentiality, integrity, and availability of any system that processes untrusted DNS requests through the affected library.

The flaw affects pjproject (PJSIP) packages with versions 2.16 and earlier. Applications that use PJSIP’s built‑in DNS resolver, such as those configured with pjsua_config.nameserver or UaConfig.nameserver in PJSUA/PJSUA2, are at risk. Systems that rely on the operating system resolver (e.g., getaddrinfo()) and do not configure a nameserver are not affected, nor are those that use an external resolver through pjsip_resolver_set_ext_resolver().

The vulnerability carries a CVSS score of 8.4, indicating high severity, but the EPSS score is less than 1 %, which suggests a low probability of being actively exploited in the wild. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector involves malicious DNS traffic; this is inferred from the nature of the DNS parser usage. Exploitation would require the target to accept DNS queries processed by the vulnerable library, providing a pathway for remote code execution.