A stack buffer overflow exists in the function pjsip_auth_create_digest2() in PJSIP. The function copies credential data using data.slen without an upper‑bound check, which allows an attacker to overflow the fixed‑size ha1 stack buffer when data.slen exceeds the expected 128‑byte digest length. This type of vulnerability (CWE‑121) can corrupt the call stack, potentially leading to a crash or arbitrary code execution if the overwritten memory contains code or control data.

The affected product is PJProject, the open‑source multimedia communication library maintained by PJSIP. Versions 2.16 and earlier are vulnerable when the application uses pre‑computed digest credentials (PJSIP_CRED_DATA_DIGEST). Any deployment that compiles with these legacy versions and processes authentication requests from untrusted sources is at risk. The vulnerability is specific to the credential handling logic in pjsip_auth_create_digest2().

The CVSS score of 8.1 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The most probable exploitation scenario involves an attacker sending crafted authentication data to a service that uses the vulnerable library; the missing upper‑bound check on data.slen can cause a stack overflow that may allow remote code execution or local privilege escalation. The potential attack vector is inferred to be network‑based, given that authentication exchanges occur over the network. Organizations using the affected library should prioritize remediation.