PJSIP's telnet command line interface contains a stack-based buffer overflow that is triggered when a command history entry is recalled and the line is redrawn. When the recalled entry is longer than the fixed-size buffer used for the redraw, the overflow can corrupt the stack and cause the application to terminate. The overflow does not grant execution of arbitrary code, so the primary consequence is a denial‑of‑service to the running application.

The vulnerability exists in the PJLIB-UTIL telnet CLI module that ships with pjproject from pjsip. Only installations that enable the telnet CLI front‑end are affected; applications that have disabled this front‑end are unaffected.

The CVSS score of 6.3 indicates a moderate severity, and the lack of an EPSS score or KEV listing means no public exploitation data is currently available. Exploitation requires access to the unauthenticated telnet CLI, which already allows arbitrary CLI commands. The additional impact of the overflow is limited to application termination, providing a denial‑of‑service vector rather than remote code execution.