PJSIP contains a stack buffer overflow when processing Service‑Route headers in a registration response. The library stores these URIs in a fixed‑size array without checking the header count, allowing an attacker to send many Service‑Route headers and cause the stack to be overwritten. The overwritten data are internal pointers, so the most likely outcome is unexpected application termination, though additional memory corruption cannot be ruled out.

The flaw affects applications that use the PJSUA/PJSUA2 account API to register with a SIP service. It exists in the pjproject library prior to the commit that fixed the issue.

The vulnerability has a CVSS score of 8.8 and is not listed in the CISA KEV catalog. EPSS information is not available. Exploitation requires a registrar that can return a malicious 2xx REGISTER response or, over unprotected transports, a spoofed response. The impact is primarily denial of service, potentially leading to application crash for a single affected instance.