CVE-2026-41416
PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an integer overflow in media stream buffer size calculation when processing SDP with asymmetric ptime configuration. The overflow may result in an undersized buffer allocation, which can lead to unexpected application termination or memory corruption This vulnerability is fixed in 2.17.
Ver en NVDAnálisis
PJSIP 2.16 and earlier contains an integer overflow vulnerability in its media stream buffer calculation during SDP processing. Applications and servers using this library for VoIP or WebRTC, such as Asterisk or custom softphones, are vulnerable to memory corruption or crashes when receiving malicious session descriptions.
Severidad
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCWE-190EPSS
Afecta
teluu:pjsipDescripción técnica
PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an integer overflow in media stream buffer size calculation when processing SDP with asymmetric ptime configuration. The overflow may result in an undersized buffer allocation, which can lead to unexpected application termination or memory corruption This vulnerability is fixed in 2.17.