Technical impact
PJSIP, a multimedia communication library, contains an out-of-bounds heap read in its multipart parsing routine (pjsip_multipart_parse). When a SIP message containing a multipart body is processed, the routine advances a pointer past the boundary delimiter without checking that the move stays within the buffer. This allows the reading of one or two bytes from adjacent heap memory. If malicious content is supplied, an attacker could potentially obtain sensitive information that resides next to the buffer, leading to a partial disclosure of data that could aid in further exploitation.
Affected Systems
This issue affects the pjsip project (pjproject) versions 2.16 and earlier. Any application that uses PJSIP and processes incoming SIP messages with multipart bodies or includes SDP content is at risk. Specific vendors are not listed beyond the pjsip project itself.
Risk and Exploitability
The vulnerability has a CVSS score of 6.9, indicating a moderate severity. The EPSS score is below 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation. Attackers would need to send crafted SIP messages containing multipart or SDP content to trigger the out-of-bounds read, which is feasible over the network. Once triggered, the read could leak a small amount of adjacent heap data; however, due to the limited size of the data read, exploitation potential is limited without additional vulnerabilities.
Debian DLA