Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-57160— PJSIP: SIP message header buffer overflow

Quick assessment

Affected
pjsip pjproject
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PJSIP 是一个免费的开源多媒体通信库，使用 C 语言编写。在提交 d6a0e7f 之前， 函数（位于 ）中可能存在缓冲区溢出漏洞。该函数负责序列化通用数组头字段（如 Allow、Require、Supported 和 Unsupported）。在某些输出缓冲区的边界条件下，该函数可能会在缓冲区末尾之外多写一个字节。该漏洞主要影响需要解析并重新序列化传入 SIP 请求的应用程序（例如代理服务器、SBC 或 B2BUA），其中远程对等方可以影响序列化后的消息内容。该越界写入仅涉及一个固定的字节；尚未证明可由此实现代

CVSS 6.9 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
pjsip pjproject < d6a0e7f76611c3a6f530ee051e3e7a622bb1748c affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-57160

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PJSIP: SIP message header buffer overflow
Source: CVE Program / CVE List V5
Vulnerability Description
PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c, the function that serializes generic array headers (such as Allow, Require, Supported, and Unsupported). Under certain output-buffer boundary conditions the function can write one byte past the end of the buffer. This is reachable mainly in applications that parse and re-serialize incoming SIP requests — for example a proxy, SBC, or B2BUA — where a remote peer can influence the serialized message. The out-of-bounds write is a single fixed byte; code execution and information disclosure are not demonstrated, and in typical pool-based allocations the byte falls within allocation slack. This issue has been patched via commit d6a0e7f.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
Off-by-one错误
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pjsip pjproject < d6a0e7f76611c3a6f530ee051e3e7a622bb1748c -

II. Public POCs for CVE-2026-57160

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-57160

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-57160 (1)

Vendor Advisories for CVE-2026-57160 (1)

Same Patch Batch · pjsip · 2026-09-04 · 8 CVEs total

CVE-2026-57163 8.8 HIGH PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend
CVE-2026-57162 8.8 HIGH PJSIP: Stack overflow parsing SDP a=crypto attributes
CVE-2026-57161 8.8 HIGH PJSIP: Stack overflow handling Service-Route headers in a registration response
CVE-2026-57159 8.4 HIGH PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance
CVE-2026-57164 8.3 HIGH PJSIP: Heap overflow in the HTTP client
CVE-2026-57165 6.3 MEDIUM PJSIP: Pre-authentication overflow in the telnet CLI history
CVE-2026-57166 6.3 MEDIUM PJSIP: Pre-authentication overflow in the telnet CLI error

IV. Related Vulnerabilities

Same product: pjproject
Same vendor: pjsip
Same weakness: CWE-193

V. Comments for CVE-2026-57160

No comments yet

Leave a comment