{"id":"CVE-2026-57162","title":"PJSIP is a free and open source multimedia communication library written in C","summary":"PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer (sdes_enc…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwe":["CWE-121"],"vendor":"teluu","product":"pjsip","affected":["pjsip <= 2.17"],"published":"2026-09-04","updated":"2026-09-11","sourceUpdated":"2026-09-11T15:51:10.693","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57162","references":[{"url":"https://github.com/pjsip/pjproject/commit/a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9","label":"security-advisories@github.com"},{"url":"https://github.com/pjsip/pjproject/security/advisories/GHSA-m9g3-jcj8-qjfm","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57162.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-57162"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57162"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00351,"epssPercentile":0.28798,"scores":{"nvd":9.1,"vendor":9.8},"ingestedAt":"2026-09-08T22:12:30.947Z","slug":"CVE-2026-57162","body":"## Overview\n\nPJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer (sdes_encode_sdp() in transport_srtp_sdes.c). This affects applications with SRTP enabled (use_srtp optional or mandatory, using SDES keying). During media negotiation, the crypto attributes from the remote SDP are collected into a fixed-size array without bounding their number; a remote peer that includes an excessive number of a=crypto attributes in a single media description can write past the end of that array on the stack. This is reachable from an incoming SIP INVITE during offer/answer, before application-level authentication. Impact may range from unexpected application termination to control flow hijack/memory corruption. Applications that do not enable SRTP are not affected. This issue has been patched via commit a1b707c.\n\n## Affected\n\n- `pjsip <= 2.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57162.json)","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201813,"id":"CVE-2026-57162","ts":1789399726465,"field":"cvss","old":null,"new":"9.1"},{"seq":201812,"id":"CVE-2026-57162","ts":1789399726465,"field":"severity","old":"none","new":"critical"},{"seq":200543,"id":"CVE-2026-57162","ts":1789397379607,"field":"cvss","old":"9.1","new":null},{"seq":200542,"id":"CVE-2026-57162","ts":1789397379607,"field":"severity","old":"critical","new":"none"},{"seq":198460,"id":"CVE-2026-57162","ts":1789391969173,"field":"cvss","old":null,"new":"9.1"},{"seq":198459,"id":"CVE-2026-57162","ts":1789391969173,"field":"severity","old":"none","new":"critical"},{"seq":196253,"id":"CVE-2026-57162","ts":1789383585833,"field":"cvss","old":"9.1","new":null},{"seq":196252,"id":"CVE-2026-57162","ts":1789383585833,"field":"severity","old":"critical","new":"none"},{"seq":195182,"id":"CVE-2026-57162","ts":1789380475426,"field":"cvss","old":null,"new":"9.1"},{"seq":195181,"id":"CVE-2026-57162","ts":1789380475426,"field":"severity","old":"none","new":"critical"},{"seq":193969,"id":"CVE-2026-57162","ts":1789378523138,"field":"cvss","old":"9.1","new":null},{"seq":193968,"id":"CVE-2026-57162","ts":1789378523138,"field":"severity","old":"critical","new":"none"},{"seq":192756,"id":"CVE-2026-57162","ts":1789376407619,"field":"cvss","old":null,"new":"9.1"},{"seq":192755,"id":"CVE-2026-57162","ts":1789376407619,"field":"severity","old":"none","new":"critical"},{"seq":191543,"id":"CVE-2026-57162","ts":1789373424842,"field":"cvss","old":"9.1","new":null},{"seq":191542,"id":"CVE-2026-57162","ts":1789373424842,"field":"severity","old":"critical","new":"none"},{"seq":190328,"id":"CVE-2026-57162","ts":1789369300579,"field":"cvss","old":null,"new":"9.1"},{"seq":190327,"id":"CVE-2026-57162","ts":1789369300579,"field":"severity","old":"none","new":"critical"},{"seq":189115,"id":"CVE-2026-57162","ts":1789368267782,"field":"cvss","old":"9.1","new":null},{"seq":189114,"id":"CVE-2026-57162","ts":1789368267782,"field":"severity","old":"critical","new":"none"},{"seq":187898,"id":"CVE-2026-57162","ts":1789365143746,"field":"cvss","old":null,"new":"9.1"},{"seq":187897,"id":"CVE-2026-57162","ts":1789365143746,"field":"severity","old":"none","new":"critical"},{"seq":186685,"id":"CVE-2026-57162","ts":1789363276304,"field":"cvss","old":"9.1","new":null},{"seq":186684,"id":"CVE-2026-57162","ts":1789363276304,"field":"severity","old":"critical","new":"none"},{"seq":185471,"id":"CVE-2026-57162","ts":1789361101763,"field":"cvss","old":null,"new":"9.1"},{"seq":185470,"id":"CVE-2026-57162","ts":1789361101763,"field":"severity","old":"none","new":"critical"},{"seq":184258,"id":"CVE-2026-57162","ts":1789358156438,"field":"cvss","old":"9.1","new":null},{"seq":184257,"id":"CVE-2026-57162","ts":1789358156438,"field":"severity","old":"critical","new":"none"},{"seq":182509,"id":"CVE-2026-57162","ts":1789354222832,"field":"cvss","old":null,"new":"9.1"},{"seq":182508,"id":"CVE-2026-57162","ts":1789354222832,"field":"severity","old":"none","new":"critical"},{"seq":181302,"id":"CVE-2026-57162","ts":1789353123946,"field":"cvss","old":"9.1","new":null},{"seq":181301,"id":"CVE-2026-57162","ts":1789353123946,"field":"severity","old":"critical","new":"none"},{"seq":180095,"id":"CVE-2026-57162","ts":1789350169511,"field":"cvss","old":null,"new":"9.1"},{"seq":180094,"id":"CVE-2026-57162","ts":1789350169511,"field":"severity","old":"none","new":"critical"},{"seq":178888,"id":"CVE-2026-57162","ts":1789348102218,"field":"cvss","old":"9.1","new":null},{"seq":178887,"id":"CVE-2026-57162","ts":1789348102218,"field":"severity","old":"critical","new":"none"},{"seq":177681,"id":"CVE-2026-57162","ts":1789346277998,"field":"cvss","old":null,"new":"9.1"},{"seq":177680,"id":"CVE-2026-57162","ts":1789346277998,"field":"severity","old":"none","new":"critical"},{"seq":176474,"id":"CVE-2026-57162","ts":1789343019273,"field":"cvss","old":"9.1","new":null},{"seq":176473,"id":"CVE-2026-57162","ts":1789343019273,"field":"severity","old":"critical","new":"none"},{"seq":174591,"id":"CVE-2026-57162","ts":1789334771981,"field":"cvss","old":null,"new":"9.1"},{"seq":174590,"id":"CVE-2026-57162","ts":1789334771981,"field":"severity","old":"none","new":"critical"},{"seq":173386,"id":"CVE-2026-57162","ts":1789333515647,"field":"cvss","old":"9.1","new":null},{"seq":173385,"id":"CVE-2026-57162","ts":1789333515647,"field":"severity","old":"critical","new":"none"},{"seq":172200,"id":"CVE-2026-57162","ts":1789331018435,"field":"cvss","old":null,"new":"9.1"},{"seq":172199,"id":"CVE-2026-57162","ts":1789331018435,"field":"severity","old":"none","new":"critical"},{"seq":171014,"id":"CVE-2026-57162","ts":1789328618143,"field":"cvss","old":"9.1","new":null},{"seq":171013,"id":"CVE-2026-57162","ts":1789328618143,"field":"severity","old":"critical","new":"none"},{"seq":169809,"id":"CVE-2026-57162","ts":1789327051376,"field":"cvss","old":null,"new":"9.1"},{"seq":169808,"id":"CVE-2026-57162","ts":1789327051376,"field":"severity","old":"none","new":"critical"}]}