An out‑of‑bounds write occurs when the PJLIB‑UTIL HTTP client in PJProject expands its response buffer based on a server‑supplied Content‑Length. If the calculation underestimates the required size, the buffer is too small and subsequent writes spill past the allocation, corrupting memory. A malicious or man‑in‑the‑middle server can trigger this by sending a crafted HTTP response, potentially causing the application to crash or, in the worst case, enabling arbitrary code execution if the overwritten region is used in control flow.

The vulnerability afflicts the http_client.c component of the PJLIB‑UTIL API within the pjproject multimedia communication library. All builds that include this component and have not been updated with commit 8d5956a are affected. Applications that rely on pjproject to receive whole HTTP responses without incremental data callbacks are at risk.

The CVSS score of 8.3 denotes high severity. The EPSS score is not available and the issue is not listed in CISA KEV, but these facts do not lessen the likelihood of exploitation. The flaw is triggered by a crafted HTTP response, meaning an attacker with network access can trigger the overflow remotely without needing local privileges. The vulnerability can be exercised without additional conditions, making it a potent denial‑of‑service and potential code‑execution risk.