{"id":"CVE-2026-57163","title":"PJSIP is a free and open source multimedia communication library written in C","summary":"PJSIP is a free and open source multimedia communication library written in C. Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate (t…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwe":["CWE-121"],"vendor":"teluu","product":"pjsip","affected":["pjsip <= 2.17"],"published":"2026-09-04","updated":"2026-09-11","sourceUpdated":"2026-09-11T15:51:33.793","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57163","references":[{"url":"https://github.com/pjsip/pjproject/commit/c4a151af86fadd16d9480b2603eeb2abf4fb4f78","label":"security-advisories@github.com"},{"url":"https://github.com/pjsip/pjproject/security/advisories/GHSA-jm2j-6rg6-qvwx","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57163.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-57163"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57163"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00402,"epssPercentile":0.31605,"scores":{"nvd":9.1,"vendor":9.8},"ingestedAt":"2026-09-08T22:12:30.947Z","slug":"CVE-2026-57163","body":"## Overview\n\nPJSIP is a free and open source multimedia communication library written in C. Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate (tls_cert_get_info() in ssl_sock_gtls.c). Only GnuTLS builds are affected (--with-gnutls); OpenSSL and Apple SecureTransport/Network.framework builds are not affected. While extracting certificate information after a TLS handshake, an incorrect buffer-size value can cause an oversized SubjectAltName entry to be written past the end of a fixed-size stack buffer. A network-positioned attacker presenting a crafted certificate — a malicious server to a connecting client, or a malicious client to a server that requests certificates — can trigger this during the TLS handshake, before any SIP-level authentication. Impact may range from unexpected application termination to control flow hijack/memory corruption. This issue has been patched via commit c4a151a.\n\n## Affected\n\n- `pjsip <= 2.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57163.json)","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201815,"id":"CVE-2026-57163","ts":1789399726478,"field":"cvss","old":null,"new":"9.1"},{"seq":201814,"id":"CVE-2026-57163","ts":1789399726478,"field":"severity","old":"none","new":"critical"},{"seq":200545,"id":"CVE-2026-57163","ts":1789397379758,"field":"cvss","old":"9.1","new":null},{"seq":200544,"id":"CVE-2026-57163","ts":1789397379758,"field":"severity","old":"critical","new":"none"},{"seq":198462,"id":"CVE-2026-57163","ts":1789391969180,"field":"cvss","old":null,"new":"9.1"},{"seq":198461,"id":"CVE-2026-57163","ts":1789391969180,"field":"severity","old":"none","new":"critical"},{"seq":196255,"id":"CVE-2026-57163","ts":1789383585847,"field":"cvss","old":"9.1","new":null},{"seq":196254,"id":"CVE-2026-57163","ts":1789383585847,"field":"severity","old":"critical","new":"none"},{"seq":195184,"id":"CVE-2026-57163","ts":1789380475432,"field":"cvss","old":null,"new":"9.1"},{"seq":195183,"id":"CVE-2026-57163","ts":1789380475432,"field":"severity","old":"none","new":"critical"},{"seq":193971,"id":"CVE-2026-57163","ts":1789378523269,"field":"cvss","old":"9.1","new":null},{"seq":193970,"id":"CVE-2026-57163","ts":1789378523269,"field":"severity","old":"critical","new":"none"},{"seq":192758,"id":"CVE-2026-57163","ts":1789376407627,"field":"cvss","old":null,"new":"9.1"},{"seq":192757,"id":"CVE-2026-57163","ts":1789376407627,"field":"severity","old":"none","new":"critical"},{"seq":191545,"id":"CVE-2026-57163","ts":1789373424984,"field":"cvss","old":"9.1","new":null},{"seq":191544,"id":"CVE-2026-57163","ts":1789373424984,"field":"severity","old":"critical","new":"none"},{"seq":190330,"id":"CVE-2026-57163","ts":1789369300588,"field":"cvss","old":null,"new":"9.1"},{"seq":190329,"id":"CVE-2026-57163","ts":1789369300588,"field":"severity","old":"none","new":"critical"},{"seq":189117,"id":"CVE-2026-57163","ts":1789368267796,"field":"cvss","old":"9.1","new":null},{"seq":189116,"id":"CVE-2026-57163","ts":1789368267796,"field":"severity","old":"critical","new":"none"},{"seq":187900,"id":"CVE-2026-57163","ts":1789365143753,"field":"cvss","old":null,"new":"9.1"},{"seq":187899,"id":"CVE-2026-57163","ts":1789365143753,"field":"severity","old":"none","new":"critical"},{"seq":186687,"id":"CVE-2026-57163","ts":1789363276441,"field":"cvss","old":"9.1","new":null},{"seq":186686,"id":"CVE-2026-57163","ts":1789363276441,"field":"severity","old":"critical","new":"none"},{"seq":185473,"id":"CVE-2026-57163","ts":1789361101771,"field":"cvss","old":null,"new":"9.1"},{"seq":185472,"id":"CVE-2026-57163","ts":1789361101771,"field":"severity","old":"none","new":"critical"},{"seq":184260,"id":"CVE-2026-57163","ts":1789358156452,"field":"cvss","old":"9.1","new":null},{"seq":184259,"id":"CVE-2026-57163","ts":1789358156452,"field":"severity","old":"critical","new":"none"},{"seq":182511,"id":"CVE-2026-57163","ts":1789354222840,"field":"cvss","old":null,"new":"9.1"},{"seq":182510,"id":"CVE-2026-57163","ts":1789354222840,"field":"severity","old":"none","new":"critical"},{"seq":181304,"id":"CVE-2026-57163","ts":1789353124086,"field":"cvss","old":"9.1","new":null},{"seq":181303,"id":"CVE-2026-57163","ts":1789353124086,"field":"severity","old":"critical","new":"none"},{"seq":180097,"id":"CVE-2026-57163","ts":1789350169517,"field":"cvss","old":null,"new":"9.1"},{"seq":180096,"id":"CVE-2026-57163","ts":1789350169517,"field":"severity","old":"none","new":"critical"},{"seq":178890,"id":"CVE-2026-57163","ts":1789348102233,"field":"cvss","old":"9.1","new":null},{"seq":178889,"id":"CVE-2026-57163","ts":1789348102233,"field":"severity","old":"critical","new":"none"},{"seq":177683,"id":"CVE-2026-57163","ts":1789346278005,"field":"cvss","old":null,"new":"9.1"},{"seq":177682,"id":"CVE-2026-57163","ts":1789346278005,"field":"severity","old":"none","new":"critical"},{"seq":176476,"id":"CVE-2026-57163","ts":1789343019287,"field":"cvss","old":"9.1","new":null},{"seq":176475,"id":"CVE-2026-57163","ts":1789343019287,"field":"severity","old":"critical","new":"none"},{"seq":174593,"id":"CVE-2026-57163","ts":1789334771988,"field":"cvss","old":null,"new":"9.1"},{"seq":174592,"id":"CVE-2026-57163","ts":1789334771988,"field":"severity","old":"none","new":"critical"},{"seq":173388,"id":"CVE-2026-57163","ts":1789333515654,"field":"cvss","old":"9.1","new":null},{"seq":173387,"id":"CVE-2026-57163","ts":1789333515654,"field":"severity","old":"critical","new":"none"},{"seq":172202,"id":"CVE-2026-57163","ts":1789331018441,"field":"cvss","old":null,"new":"9.1"},{"seq":172201,"id":"CVE-2026-57163","ts":1789331018441,"field":"severity","old":"none","new":"critical"},{"seq":171016,"id":"CVE-2026-57163","ts":1789328618270,"field":"cvss","old":"9.1","new":null},{"seq":171015,"id":"CVE-2026-57163","ts":1789328618270,"field":"severity","old":"critical","new":"none"},{"seq":169811,"id":"CVE-2026-57163","ts":1789327051382,"field":"cvss","old":null,"new":"9.1"},{"seq":169810,"id":"CVE-2026-57163","ts":1789327051382,"field":"severity","old":"none","new":"critical"}]}