Description
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c uses payload-type numbers taken from a remote SDP offer or answer to index fixed-size internal tables without sufficient bounds validation, so a crafted remote SDP can cause memory access outside those tables. The practical impact is memory corruption and denial of service; code execution is not demonstrated. This path is only reached when PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP is enabled. The default is disabled, so default builds are not affected; the feature is an interoperability option that integrating products may enable. This issue has been patched via commit 673b978.
Published: 2026-09-04
Score: 8.4 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An out‑of‑bounds read and write in the SDP negotiator can corrupt memory when a remote SIP offer or answer supplies an unexpected payload type number. The issue is limited to the remote payload‑type map maintenance feature and has not been shown to lead to code execution. The consequence is clear memory corruption and a resulting denial of service for the affected process.

Affected Systems

The vulnerability affects all builds of the PJSIP pjproject library that use the remote payload‑type map maintenance feature. It is present in all versions prior to Git commit 673b978, which introduced a bounds check. Products that enable the PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP option are at risk while default builds remain unaffected.

Risk and Exploitability

The CVSS score of 8.4 highlights a serious impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploits yet. Nonetheless, the attack vector is remote: a crafted SDP message from an external party can trigger the flaw. An attacker would need to transmit a specifically constructed SDP offer or answer to an endpoint that has the feature enabled. Exacerbation occurs only when the feature is active, so risk is reduced in default configurations.

Generated by OpenCVE AI on September 4, 2026 at 19:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to pjproject commit 673b978 or later, which adds bounds validation to the SDP packet parser.
  • Disable the PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP option if interoperability with foreign endpoints is not required.
  • If a patch cannot be applied immediately, limit inbound SDP offers to known, trusted sources and validate payload type numbers before processing to avoid out‑of‑bounds access.

Generated by OpenCVE AI on September 4, 2026 at 19:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Pjsip
Pjsip pjproject
Vendors & Products Pjsip
Pjsip pjproject

Fri, 04 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c uses payload-type numbers taken from a remote SDP offer or answer to index fixed-size internal tables without sufficient bounds validation, so a crafted remote SDP can cause memory access outside those tables. The practical impact is memory corruption and denial of service; code execution is not demonstrated. This path is only reached when PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP is enabled. The default is disabled, so default builds are not affected; the feature is an interoperability option that integrating products may enable. This issue has been patched via commit 673b978.
Title PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance
Weaknesses CWE-129
CWE-787
References
Metrics cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Pjsip Pjproject
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-04T17:11:26.957Z

Reserved: 2026-06-24T01:45:48.698Z

Link: CVE-2026-57159

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T18:17:53.313

Modified: 2026-09-04T18:17:53.313

Link: CVE-2026-57159

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T21:30:07Z

Weaknesses
  • CWE-129

    Improper Validation of Array Index

  • CWE-787

    Out-of-bounds Write