Description
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 4472a31, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when rendering feedback for an entered command line. Several command-line handling paths write an attacker-influenced amount of data into fixed-size buffers without sufficient bounds checking, so a long command line can overflow them. This affects only applications that enable the telnet CLI front-end (e.g. pj_cli_telnet_create() / --cli-telnet-port). The telnet CLI is an interactive administration interface with no authentication, so any client able to reach it can already issue arbitrary CLI commands. A malformed or overly long command line can overflow a fixed-size stack buffer while rendering command-line feedback, which may lead to application termination. Because reaching this code already requires access to the unauthenticated CLI, the impact beyond that existing access is limited. Applications that do not enable the telnet CLI front-end are not affected. This issue has been patched via commit 4472a31.
Published: 2026-09-04
Score: 6.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

PJSIP contains a stack buffer overflow in the telnet CLI front‑end that occurs while rendering feedback for entered commands. A command line that is too long can overflow a fixed‑size buffer, causing the application to crash. The vulnerability is triggered only when the telnet CLI is enabled, and the interface is inherently unauthenticated. Consequently, an attacker who can reach the CLI can already issue arbitrary commands; the overflow merely adds the possibility of application termination rather than granting additional privileges.

Affected Systems

The affected product is the PJSIP pjproject library, specifically applications that enable the telnet CLI front‑end (for example by calling pj_cli_telnet_create() or using the --cli-telnet-port option). No specific version numbers are listed, but the issue is fixed in the commit referenced in the advisory.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity, and the EPSS score is not provided. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs unauthenticated network access to the telnet CLI port to be able to send a long command line that triggers the overflow, which may terminate the process. The impact does not extend beyond the already available unauthenticated CLI access.

Generated by OpenCVE AI on September 4, 2026 at 18:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the hotfix commit 4472a31 or upgrade to the latest pjproject release that includes the patch.
  • If the telnet CLI is unnecessary, disable or remove pj_cli_telnet_create() from the application and close the associated port.
  • Restrict network access to the telnet CLI port with firewall or network segmentation so only trusted hosts can reach it.

Generated by OpenCVE AI on September 4, 2026 at 18:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Pjsip
Pjsip pjproject
Vendors & Products Pjsip
Pjsip pjproject

Fri, 04 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description PJSIP is a free and open source multimedia communication library written in C. Prior to commit 4472a31, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when rendering feedback for an entered command line. Several command-line handling paths write an attacker-influenced amount of data into fixed-size buffers without sufficient bounds checking, so a long command line can overflow them. This affects only applications that enable the telnet CLI front-end (e.g. pj_cli_telnet_create() / --cli-telnet-port). The telnet CLI is an interactive administration interface with no authentication, so any client able to reach it can already issue arbitrary CLI commands. A malformed or overly long command line can overflow a fixed-size stack buffer while rendering command-line feedback, which may lead to application termination. Because reaching this code already requires access to the unauthenticated CLI, the impact beyond that existing access is limited. Applications that do not enable the telnet CLI front-end are not affected. This issue has been patched via commit 4472a31.
Title PJSIP: Pre-authentication overflow in the telnet CLI error
Weaknesses CWE-121
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Pjsip Pjproject
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-04T17:12:10.146Z

Reserved: 2026-06-24T01:47:55.285Z

Link: CVE-2026-57166

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T18:17:55.007

Modified: 2026-09-04T18:17:55.007

Link: CVE-2026-57166

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T21:30:07Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow