CVE-2026-57159 pjsip CVE debrief

Who should care

Defenders of systems integrating PJSIP, especially those enabling the remote payload-type map maintenance feature, should assess exposure and apply the patch. This includes verifying PJSIP configurations, reviewing security settings, and ensuring the patch from commit 673b978 is applied. The vulnerability's practical impact is memory corruption and denial of service, with no demonstrated code execution, but it can affect service availability and data.

Why it matters

CVE-2026-57159 is a remote out-of-bounds read and write vulnerability in PJSIP's SDP negotiator when the remote payload-type map maintenance feature is enabled, potentially leading to denial of service and memory corruption. Defenders should verify exposure in PJSIP integrations, especially those with the feature enabled, and apply the patch from commit 673b978. The vulnerability's practical impact is memory corruption and denial of service, with no demonstrated code execution. Default PJSIP builds are not affected as the feature is disabled by default.

• Denial of service attacks may target vulnerable PJSIP systems.
• Memory corruption can occur due to out-of-bounds reads and writes.
• Verification of PJSIP configurations and patch application is necessary.
• Exposure assessment is required for PJSIP integrations with the remote payload-type map maintenance feature enabled.

Technical summary

The vulnerability exists in the SDP negotiator of PJSIP when the remote payload-type map maintenance feature is enabled. A crafted remote SDP can cause memory access outside internal tables, leading to memory corruption and denial of service. The issue arises from insufficient bounds validation in assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c. The patch in commit 673b978 addresses this vulnerability by enhancing the validation of payload-type numbers from remote SDP offers or answers, preventing memory access outside the fixed-size internal tables.

Defensive priority

Defenders should prioritize verifying exposure in PJSIP integrations that enable the remote payload-type map maintenance feature and apply the patch from commit 673b978.

Recommended defensive actions

• Verify if PJSIP integrations enable the remote payload-type map maintenance feature.
• Check for the patch from commit 673b978 in PJSIP implementations.
• Monitor for potential denial-of-service attacks targeting PJSIP systems.
• Review PJSIP configurations for secure settings.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the patch. However, the corpus does not establish versions, exploitation, impact, or remediation for all affected systems, requiring verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.