Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-57162— PJSIP: Stack overflow parsing SDP a=crypto attributes

Quick assessment

Affected
pjsip pjproject
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PJSIP 是一个用 C 语言编写的免费且开源的多媒体通信库。在提交 a1b707c 之前，SRTP/SDES 媒体传输模块在处理 SDP 提供/应答过程中的 属性时，存在一个栈缓冲区溢出漏洞（具体位于 中的 函数）。该漏洞影响启用了 SRTP 的应用程序（即 SRTP 被设为可选或强制使用，且使用 SDES 密钥交换方式）。在媒体协商过程中，来自远端 SDP 的 crypto 属性被收集到一个固定大小的数组中，但未对其数量进行限制；如果远端对等体在单个媒体描述中包含了过多 属性，就可能导致写入超出该栈上数组的末尾

CVSS 8.8 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
pjsip pjproject < a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-57162

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PJSIP: Stack overflow parsing SDP a=crypto attributes
Source: CVE Program / CVE List V5
Vulnerability Description
PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer (sdes_encode_sdp() in transport_srtp_sdes.c). This affects applications with SRTP enabled (use_srtp optional or mandatory, using SDES keying). During media negotiation, the crypto attributes from the remote SDP are collected into a fixed-size array without bounding their number; a remote peer that includes an excessive number of a=crypto attributes in a single media description can write past the end of that array on the stack. This is reachable from an incoming SIP INVITE during offer/answer, before application-level authentication. Impact may range from unexpected application termination to control flow hijack/memory corruption. Applications that do not enable SRTP are not affected. This issue has been patched via commit a1b707c.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pjsip pjproject < a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9 -

II. Public POCs for CVE-2026-57162

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-57162

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-57162 (1)

Vendor Advisories for CVE-2026-57162 (1)

Same Patch Batch · pjsip · 2026-09-04 · 8 CVEs total

CVE-2026-57163 8.8 HIGH PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend
CVE-2026-57161 8.8 HIGH PJSIP: Stack overflow handling Service-Route headers in a registration response
CVE-2026-57159 8.4 HIGH PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance
CVE-2026-57164 8.3 HIGH PJSIP: Heap overflow in the HTTP client
CVE-2026-57160 6.9 MEDIUM PJSIP: SIP message header buffer overflow
CVE-2026-57165 6.3 MEDIUM PJSIP: Pre-authentication overflow in the telnet CLI history
CVE-2026-57166 6.3 MEDIUM PJSIP: Pre-authentication overflow in the telnet CLI error

IV. Related Vulnerabilities

Same product: pjproject
Same vendor: pjsip
Same weakness: CWE-121

V. Comments for CVE-2026-57162

No comments yet

Leave a comment