CVE-2022-24793 in PJSIP
Summary
by MITRE • 04/06/2022
PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.12 and prior affects applications that use PJSIP DNS resolution. It doesn't affect PJSIP users who utilize an external resolver. This vulnerability is related to CVE-2023-27585. The difference is that this issue is in parsing the query record `parse_rr()`, while the issue in CVE-2023-27585 is in `parse_query()`. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver instead.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/05/2026
The vulnerability CVE-2022-24793 represents a critical buffer overflow flaw within the PJSIP multimedia communication library that impacts versions 2.12 and earlier. This security issue specifically targets applications utilizing PJSIP's built-in DNS resolution capabilities, creating a potential pathway for remote code execution or system compromise. The vulnerability stems from improper input validation during DNS record parsing operations, particularly within the parse_rr() function that processes resource record data. The affected library serves as a foundational component for numerous VoIP and multimedia communication applications, making this flaw particularly concerning for organizations relying on PJSIP for their communication infrastructure.
Technical exploitation of this buffer overflow occurs when PJSIP processes malformed DNS query records through the parse_rr() function, which fails to properly validate input boundaries before copying data into fixed-size buffers. This flaw falls under CWE-121, which describes heap-based buffer overflow conditions, and aligns with ATT&CK technique T1203, where adversaries may exploit buffer overflows to execute arbitrary code. The vulnerability specifically manifests when applications attempt to resolve DNS records using PJSIP's internal DNS resolver rather than external resolution mechanisms, creating a direct attack surface for malicious actors who can craft specially malformed DNS responses to trigger the overflow condition.
The operational impact of CVE-2022-24793 extends beyond simple application crashes, potentially enabling remote attackers to execute arbitrary code on systems running vulnerable PJSIP implementations. This threat is particularly severe in environments where PJSIP is used for real-time communication services, as attackers could compromise voice and video communication infrastructure. The vulnerability affects organizations using PJSIP's default DNS resolution behavior, which is common in many VoIP deployments, PBX systems, and multimedia applications. Security teams must consider that the flaw may be exploited in conjunction with other vulnerabilities, as demonstrated by its relationship to CVE-2023-27585, which addresses a similar parsing issue in the parse_query() function, indicating a broader pattern of DNS parsing vulnerabilities within the library.
Mitigation strategies for CVE-2022-24793 include immediate patching of PJSIP installations to versions beyond 2.12, with the official fix available in the master branch of the pjsip/pjproject GitHub repository. Organizations should prioritize deployment of this patch across all systems utilizing vulnerable PJSIP versions, particularly those running applications that depend on internal DNS resolution. Alternative workarounds include disabling DNS resolution within PJSIP configuration by setting nameserver_count to zero, which forces applications to rely on external DNS resolvers, or implementing external DNS resolution mechanisms that provide additional security layers. Security monitoring should focus on detecting unusual DNS query patterns or malformed responses that might indicate exploitation attempts, while network segmentation can help limit the potential impact of successful attacks. The vulnerability serves as a reminder of the critical importance of keeping open source components updated and maintaining robust security practices for multimedia communication infrastructure.