Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-57159— PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance

Quick assessment

Affected
pjsip pjproject
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PJSIP 是一个用 C 语言编写的免费开源多媒体通信库。在提交 673b978 之前，如果启用了“远程有效载荷类型（payload-type）映射维护”功能，SDP 协商器中可能会发生远程越界读取和写入。 中的 函数直接使用从远程 SDP 提供或应答中获取的有效载荷类型编号来索引固定大小的内部表格，且缺乏充分的边界检查，因此精心构造的远程 SDP 可能导致内存访问超出这些表格的范围。该漏洞的实际影响是内存损坏和服务拒绝（DoS）；目前尚未证明会导致代码执行。该代码路径仅在启用 时才会被触发。默认情况下该功能处于禁

CVSS 8.4 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
pjsip pjproject < 673b978aab1fe3ab874247be32c871acc880cbeb affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-57159

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance
Source: CVE Program / CVE List V5
Vulnerability Description
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c uses payload-type numbers taken from a remote SDP offer or answer to index fixed-size internal tables without sufficient bounds validation, so a crafted remote SDP can cause memory access outside those tables. The practical impact is memory corruption and denial of service; code execution is not demonstrated. This path is only reached when PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP is enabled. The default is disabled, so default builds are not affected; the feature is an interoperability option that integrating products may enable. This issue has been patched via commit 673b978.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数组索引的验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pjsip pjproject < 673b978aab1fe3ab874247be32c871acc880cbeb -

II. Public POCs for CVE-2026-57159

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-57159

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-57159 (1)

Vendor Advisories for CVE-2026-57159 (1)

Same Patch Batch · pjsip · 2026-09-04 · 8 CVEs total

CVE-2026-57163 8.8 HIGH PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend
CVE-2026-57162 8.8 HIGH PJSIP: Stack overflow parsing SDP a=crypto attributes
CVE-2026-57161 8.8 HIGH PJSIP: Stack overflow handling Service-Route headers in a registration response
CVE-2026-57164 8.3 HIGH PJSIP: Heap overflow in the HTTP client
CVE-2026-57160 6.9 MEDIUM PJSIP: SIP message header buffer overflow
CVE-2026-57165 6.3 MEDIUM PJSIP: Pre-authentication overflow in the telnet CLI history
CVE-2026-57166 6.3 MEDIUM PJSIP: Pre-authentication overflow in the telnet CLI error

IV. Related Vulnerabilities

Same product: pjproject
Same vendor: pjsip
Same weakness: CWE-129

V. Comments for CVE-2026-57159

No comments yet

Leave a comment