{"id":"CVE-2026-57159","title":"PJSIP is a free and open source multimedia communication library written in C","summary":"PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-129","CWE-787"],"vendor":"teluu","product":"pjsip","affected":["pjsip <= 2.17"],"published":"2026-09-04","updated":"2026-09-11","sourceUpdated":"2026-09-11T15:30:40.883","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57159","references":[{"url":"https://github.com/pjsip/pjproject/commit/673b978aab1fe3ab874247be32c871acc880cbeb","label":"security-advisories@github.com"},{"url":"https://github.com/pjsip/pjproject/security/advisories/GHSA-rfwg-w9gq-9mw2","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57159.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-57159"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57159"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.0034,"epssPercentile":0.27645,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-08T17:35:53.472556Z"},"scores":{"nvd":7.5,"cna":8.4,"vendor":8.2},"ingestedAt":"2026-09-08T18:07:34.885Z","slug":"CVE-2026-57159","body":"## Overview\n\nPJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c uses payload-type numbers taken from a remote SDP offer or answer to index fixed-size internal tables without sufficient bounds validation, so a crafted remote SDP can cause memory access outside those tables. The practical impact is memory corruption and denial of service; code execution is not demonstrated. This path is only reached when PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP is enabled. The default is disabled, so default builds are not affected; the feature is an interoperability option that integrating products may enable. This issue has been patched via commit 673b978.\n\n## Affected\n\n- `pjsip <= 2.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57159.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201808,"id":"CVE-2026-57159","ts":1789399726422,"field":"cvss","old":"8.4","new":"7.5"},{"seq":200538,"id":"CVE-2026-57159","ts":1789397379155,"field":"cvss","old":"7.5","new":"8.4"},{"seq":198455,"id":"CVE-2026-57159","ts":1789391969153,"field":"cvss","old":"8.4","new":"7.5"},{"seq":196248,"id":"CVE-2026-57159","ts":1789383585791,"field":"cvss","old":"7.5","new":"8.4"},{"seq":195177,"id":"CVE-2026-57159","ts":1789380475406,"field":"cvss","old":"8.4","new":"7.5"},{"seq":193964,"id":"CVE-2026-57159","ts":1789378522744,"field":"cvss","old":"7.5","new":"8.4"},{"seq":192751,"id":"CVE-2026-57159","ts":1789376407596,"field":"cvss","old":"8.4","new":"7.5"},{"seq":191538,"id":"CVE-2026-57159","ts":1789373424425,"field":"cvss","old":"7.5","new":"8.4"},{"seq":190323,"id":"CVE-2026-57159","ts":1789369300554,"field":"cvss","old":"8.4","new":"7.5"},{"seq":189110,"id":"CVE-2026-57159","ts":1789368267738,"field":"cvss","old":"7.5","new":"8.4"},{"seq":187893,"id":"CVE-2026-57159","ts":1789365143725,"field":"cvss","old":"8.4","new":"7.5"},{"seq":186680,"id":"CVE-2026-57159","ts":1789363275888,"field":"cvss","old":"7.5","new":"8.4"},{"seq":185466,"id":"CVE-2026-57159","ts":1789361101741,"field":"cvss","old":"8.4","new":"7.5"},{"seq":184253,"id":"CVE-2026-57159","ts":1789358156396,"field":"cvss","old":"7.5","new":"8.4"},{"seq":182504,"id":"CVE-2026-57159","ts":1789354222812,"field":"cvss","old":"8.4","new":"7.5"},{"seq":181297,"id":"CVE-2026-57159","ts":1789353123518,"field":"cvss","old":"7.5","new":"8.4"},{"seq":180090,"id":"CVE-2026-57159","ts":1789350169490,"field":"cvss","old":"8.4","new":"7.5"},{"seq":178883,"id":"CVE-2026-57159","ts":1789348102174,"field":"cvss","old":"7.5","new":"8.4"},{"seq":177676,"id":"CVE-2026-57159","ts":1789346277978,"field":"cvss","old":"8.4","new":"7.5"},{"seq":176469,"id":"CVE-2026-57159","ts":1789343019231,"field":"cvss","old":"7.5","new":"8.4"},{"seq":174586,"id":"CVE-2026-57159","ts":1789334771962,"field":"cvss","old":"8.4","new":"7.5"},{"seq":173381,"id":"CVE-2026-57159","ts":1789333515627,"field":"cvss","old":"7.5","new":"8.4"},{"seq":172195,"id":"CVE-2026-57159","ts":1789331018413,"field":"cvss","old":"8.4","new":"7.5"},{"seq":171009,"id":"CVE-2026-57159","ts":1789328617763,"field":"cvss","old":"7.5","new":"8.4"},{"seq":169804,"id":"CVE-2026-57159","ts":1789327051355,"field":"cvss","old":"8.4","new":"7.5"},{"seq":168599,"id":"CVE-2026-57159","ts":1789323660193,"field":"cvss","old":"7.5","new":"8.4"},{"seq":167394,"id":"CVE-2026-57159","ts":1789319579056,"field":"cvss","old":"8.4","new":"7.5"},{"seq":166189,"id":"CVE-2026-57159","ts":1789318562343,"field":"cvss","old":"7.5","new":"8.4"},{"seq":164984,"id":"CVE-2026-57159","ts":1789315704126,"field":"cvss","old":"8.4","new":"7.5"},{"seq":163779,"id":"CVE-2026-57159","ts":1789313453991,"field":"cvss","old":"7.5","new":"8.4"},{"seq":162574,"id":"CVE-2026-57159","ts":1789311820905,"field":"cvss","old":"8.4","new":"7.5"},{"seq":161369,"id":"CVE-2026-57159","ts":1789308525184,"field":"cvss","old":"7.5","new":"8.4"},{"seq":160874,"id":"CVE-2026-57159","ts":1789304486671,"field":"cvss","old":"8.4","new":"7.5"},{"seq":160421,"id":"CVE-2026-57159","ts":1789303991872,"field":"cvss","old":"7.5","new":"8.4"},{"seq":159482,"id":"CVE-2026-57159","ts":1789300402596,"field":"cvss","old":"8.4","new":"7.5"},{"seq":158712,"id":"CVE-2026-57159","ts":1789299495537,"field":"cvss","old":"7.5","new":"8.4"},{"seq":157676,"id":"CVE-2026-57159","ts":1789296582356,"field":"cvss","old":"8.4","new":"7.5"},{"seq":156471,"id":"CVE-2026-57159","ts":1789294596514,"field":"cvss","old":"7.5","new":"8.4"},{"seq":155266,"id":"CVE-2026-57159","ts":1789292791473,"field":"cvss","old":"8.4","new":"7.5"},{"seq":154061,"id":"CVE-2026-57159","ts":1789289592729,"field":"cvss","old":"7.5","new":"8.4"},{"seq":152711,"id":"CVE-2026-57159","ts":1789281522816,"field":"cvss","old":"8.4","new":"7.5"},{"seq":152351,"id":"CVE-2026-57159","ts":1789281123372,"field":"cvss","old":"7.5","new":"8.4"},{"seq":151312,"id":"CVE-2026-57159","ts":1789277536443,"field":"cvss","old":"8.4","new":"7.5"},{"seq":150273,"id":"CVE-2026-57159","ts":1789276110530,"field":"cvss","old":"7.5","new":"8.4"},{"seq":149240,"id":"CVE-2026-57159","ts":1789273738471,"field":"cvss","old":"8.4","new":"7.5"},{"seq":148207,"id":"CVE-2026-57159","ts":1789271125879,"field":"cvss","old":"7.5","new":"8.4"},{"seq":146242,"id":"CVE-2026-57159","ts":1789269282454,"field":"cvss","old":"8.4","new":"7.5"},{"seq":142854,"id":"CVE-2026-57159","ts":1789261369850,"field":"cvss","old":"7.5","new":"8.4"},{"seq":141685,"id":"CVE-2026-57159","ts":1789258742191,"field":"cvss","old":"8.4","new":"7.5"},{"seq":140526,"id":"CVE-2026-57159","ts":1789256582931,"field":"cvss","old":"7.5","new":"8.4"}]}