CVE-2022-24792 in PJSIP
Summary
by MITRE • 04/25/2022
PJSIP is a free and open source multimedia communication library written in C. A denial-of-service vulnerability affects applications on a 32-bit systems that use PJSIP versions 2.12 and prior to play/read invalid WAV files. The vulnerability occurs when reading WAV file data chunks with length greater than 31-bit integers. The vulnerability does not affect 64-bit apps and should not affect apps that only plays trusted WAV files. A patch is available on the `master` branch of the `pjsip/project` GitHub repository. As a workaround, apps can reject a WAV file received from an unknown source or validate the file first.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/05/2026
The CVE-2022-24792 vulnerability represents a critical denial-of-service flaw within the PJSIP multimedia communication library that specifically targets 32-bit systems running versions 2.12 and earlier. This vulnerability stems from improper handling of WAV file data chunks where the length field exceeds the maximum value that can be represented by 32-bit signed integers, creating a scenario where legitimate audio processing operations can be disrupted through crafted malicious input. The flaw exists in the core audio file parsing logic that processes WAV format data streams, making it particularly dangerous for real-time communication applications that rely heavily on audio processing capabilities. The vulnerability is classified under CWE-191 Integer Underflow/Overflow, which specifically addresses issues where integer operations produce results that fall outside the range of the data type being used. From an operational security perspective, this vulnerability creates a significant risk for telephony systems, VoIP applications, and multimedia communication platforms that utilize PJSIP for audio handling, as attackers could potentially disrupt service availability by submitting specially crafted WAV files that trigger the overflow condition.
The technical exploitation of this vulnerability requires understanding the underlying WAV file format specifications and how PJSIP processes these files within 32-bit execution environments. When PJSIP attempts to read WAV file data chunks where the chunk size exceeds 2,147,483,647 bytes (the maximum value for a 32-bit signed integer), the system experiences integer overflow conditions that can lead to unpredictable behavior including application crashes, memory corruption, or complete system unresponsiveness. This issue is specifically confined to 32-bit architectures because 64-bit systems handle larger integer values without encountering the same overflow conditions that affect their 32-bit counterparts. The vulnerability does not impact 64-bit applications or systems that only process trusted WAV files, which provides some operational mitigation but also highlights the importance of proper input validation and system architecture considerations. The flaw aligns with ATT&CK technique T1499.004, which involves network denial of service attacks through resource exhaustion or system instability, though in this case the instability stems from integer overflow rather than traditional resource depletion methods.
The operational impact of CVE-2022-24792 extends beyond simple service disruption to potentially compromise the reliability and availability of critical communication infrastructure. Applications that depend on PJSIP for real-time audio processing, including enterprise VoIP systems, teleconferencing platforms, and multimedia communication services, face significant risk of being rendered non-functional through simple malicious input. The vulnerability demonstrates the importance of proper integer handling in security-critical code paths, particularly when dealing with file format parsing where external input can control memory allocation and processing parameters. Organizations utilizing affected PJSIP versions should immediately implement the available patch from the master branch of the pjsip/project GitHub repository, which addresses the integer overflow condition by implementing proper bounds checking and validation of WAV file chunk sizes. Additionally, implementing defensive measures such as rejecting WAV files from untrusted sources or performing thorough file validation before processing can serve as effective workarounds. The vulnerability underscores the necessity of comprehensive input validation and proper integer arithmetic handling in multimedia processing libraries, particularly in environments where security and reliability are paramount considerations. From a compliance standpoint, this vulnerability may impact organizations subject to standards such as NIST SP 800-53 controls related to input validation and system protection mechanisms, making timely remediation not just a security best practice but a regulatory requirement for many enterprises.