CVE-2026-41416
PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an integer overflow in media stream buffer size calculation when processing SDP with asymmetric ptime configuration. The overflow may result in an undersized buffer allocation, which can lead to unexpected application termination or memory corruption This vulnerability is fixed in 2.17.
View on NVDAnalysis
PJSIP 2.16 and earlier contains an integer overflow vulnerability in its media stream buffer calculation during SDP processing. Applications and servers using this library for VoIP or WebRTC, such as Asterisk or custom softphones, are vulnerable to memory corruption or crashes when receiving malicious session descriptions.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCWE-190EPSS
Affects
teluu:pjsipTechnical description
PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an integer overflow in media stream buffer size calculation when processing SDP with asymmetric ptime configuration. The overflow may result in an undersized buffer allocation, which can lead to unexpected application termination or memory corruption This vulnerability is fixed in 2.17.