---
id: CVE-2026-57162
title: PJSIP is a free and open source multimedia communication library written in C
summary: >-
  PJSIP is a free and open source multimedia communication library written in C.
  Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media
  transport when processing a=crypto attributes during SDP offer/answer
  (sdes_enc…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-121
vendor: teluu
product: pjsip
affected:
  - pjsip <= 2.17
published: '2026-09-04'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T15:51:10.693'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-57162'
references:
  - url: >-
      https://github.com/pjsip/pjproject/commit/a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9
    label: security-advisories@github.com
  - url: 'https://github.com/pjsip/pjproject/security/advisories/GHSA-m9g3-jcj8-qjfm'
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57162.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-57162'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-57162'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00638
epssPercentile: 0.48317
scores:
  nvd: 9.1
  vendor: 9.8
ingestedAt: '2026-09-08T22:12:30.947Z'
---

## Overview

PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer (sdes_encode_sdp() in transport_srtp_sdes.c). This affects applications with SRTP enabled (use_srtp optional or mandatory, using SDES keying). During media negotiation, the crypto attributes from the remote SDP are collected into a fixed-size array without bounding their number; a remote peer that includes an excessive number of a=crypto attributes in a single media description can write past the end of that array on the stack. This is reachable from an incoming SIP INVITE during offer/answer, before application-level authentication. Impact may range from unexpected application termination to control flow hijack/memory corruption. Applications that do not enable SRTP are not affected. This issue has been patched via commit a1b707c.

## Affected

- `pjsip <= 2.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57162.json)