The vulnerability is a stack buffer overflow that occurs in PJSIP’s SRTP/SDES media transport when the function that parses a=crypto attributes in an SDP message receives more attributes than the fixed‑size array can hold. The overflow can corrupt the stack, leading to program termination or, if an attacker can control the overflowed data, potential hijacking of control flow and execution of arbitrary code. This flaw is identified as CWE‑121. The lack of bounds checking means that the attacker does not need to bypass authentication; the overflow can be triggered by a normal SIP INVITE that includes a malicious SDP during offer/answer negotiating media.

All installations of pjproject that have SRTP enabled with SDES keying are affected. The issue exists in every version prior to the patch commit a1b707c. Applications or deployments that do not enable SRTP, or that use SRTP with keying methods other than SDES, are not impacted.

With a CVSS score of 8.8 the flaw is high severity, but EPSS data is unavailable and it is not listed in the CISA KEV catalog. Because the vulnerability is reachable from an unauthenticated SIP INVITE during the SIP Offer/Answer phase before application‑level authentication, an attacker can craft a message that triggers the buffer overflow. The lack of a mitigated code path and the potential for control‑flow hijacking make the risk significant, especially for systems exposed to the Internet or other untrusted networks.