PJSIP contains an integer overflow in the calculation of the media stream buffer size when processing a Session Description Protocol (SDP) that uses asymmetric packet time (ptime) values. The overflow produces an undersized buffer, which can lead to memory corruption or cause the application to terminate unexpectedly. This flaw is represented by CWE-190, Integer Overflow or Wraparound.

Any installation of the PJProject library, specifically pjsip:pjproject, that uses version 2.16 or earlier is vulnerable. Systems that compile or embed older PJSIP releases would be impacted until the library is upgraded to version 2.17 or newer, which contains the fix.

The CVSS score of 8.1 classifies the vulnerability as high severity. The EPSS score of less than 1% indicates a low probability that it is being actively exploited in the wild at this time. It is not listed in the CISA KEV catalog. The likely attack surface involves an attacker sending a crafted SIP/SDP message with asymmetric ptime values to a vulnerable application that processes the media stream, potentially leading to memory corruption or denial of service.