A 1‑byte buffer overflow occurs in pjsip_generic_array_hdr_print() when serializing generic SIP headers such as Allow, Require, Supported, and Unsupported. The malformed write does not lead to code execution or information disclosure; it merely corrupts one byte of memory, which in typical pool allocations falls within slack space. The effect is limited to potential message corruption or a crash, thereby creating a possible denial of service scenario.

The flaw exists in the PJProject library (pjsip) prior to commit d6a0e7f. Any application that parses incoming SIP requests and then re‑serializes them—such as proxies, session border controllers, or back‑to‑back units—using an affected build of the library is impacted. No specific vendor version numbers are listed, so all releases before the mentioned commit are vulnerable.

The CVSS score of 6.9 denotes moderate severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. The attack can be performed remotely by sending crafted SIP requests that influence the re‑serialization process, but only a single, non‑exploitable byte is overwritten. As a result, the risk is primarily toward service availability rather than confidentiality or integrity.