pjsip pjproject SRTP/SDES Transport transport_srtp_sdes.c sdes_encode_sdp stack-based overflow

Summaryinfo

A vulnerability was found in pjsip pjproject. It has been rated as critical. This vulnerability affects the function sdes_encode_sdp of the file transport_srtp_sdes.c of the component SRTP/SDES Transport. Performing a manipulation results in stack-based overflow. This vulnerability is known as CVE-2026-57162. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability classified as critical has been found in pjsip pjproject (version unknown). This affects the function sdes_encode_sdp of the file transport_srtp_sdes.c of the component SRTP/SDES Transport. The manipulation with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer (sdes_encode_sdp() in transport_srtp_sdes.c). This affects applications with SRTP enabled (use_srtp optional or mandatory, using SDES keying). During media negotiation, the crypto attributes from the remote SDP are collected into a fixed-size array without bounding their number; a remote peer that includes an excessive number of a=crypto attributes in a single media description can write past the end of that array on the stack. This is reachable from an incoming SIP INVITE during offer/answer, before application-level authentication. Impact may range from unexpected application termination to control flow hijack/memory corruption. Applications that do not enable SRTP are not affected. This issue has been patched via commit a1b707c.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-57162 since 06/24/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

Applying the patch a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9 is able to eliminate this problem.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• pjsip

Name

• pjproject

License

• open-source

Website

• Product: https://github.com/pjsip/pjproject/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion