PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-57159 pjsip CVE debrief

A remote out-of-bounds read and write vulnerability exists in the SDP negotiator of PJSIP, a free and open-source multimedia communication library, when the remote payload-type map maintenance feature is enabled. This can lead to memory corruption and denial of service. The vulnerability is patched in commit 673b978. Defenders should assess exposure, especially in environments where the remote payload-type map maintenance feature is enabled, and apply patches accordingly. The vulnerability's practical impact includes memory corruption and denial of service, with code execution not demonstrated. PJSIP's default builds are not affected as the feature is disabled by default.

Vendor
pjsip
Product
pjproject
CVSS
HIGH 8.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-04
Original CVE updated
2026-09-11
Advisory published
2026-09-04
Advisory updated
2026-09-11

Who should care

Defenders responsible for PJSIP installations, especially those enabling the remote payload-type map maintenance feature, should assess exposure and apply patches. This includes operators managing PJSIP deployments, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of multimedia communication systems.

Why it matters

Defenders should prioritize verifying exposure and applying patches for PJSIP installations that enable the remote payload-type map maintenance feature to prevent potential denial of service and memory corruption.

  • Denial of service due to memory corruption.
  • Potential for memory access outside internal tables.
  • Need for verification of PJSIP versions and configurations.
  • Priority for applying patches and updating inventory checks.

Technical summary

The vulnerability exists in the SDP negotiator of PJSIP when the remote payload-type map maintenance feature is enabled. A crafted remote SDP can cause memory access outside internal tables, leading to memory corruption and denial of service. The assign_pt_and_update_map() function in pjmedia/src/pjmedia/sdp_neg.c uses payload-type numbers taken from a remote SDP offer or answer to index fixed-size internal tables without sufficient bounds validation. This issue has been patched via commit 673b978, and defenders should prioritize verifying exposure and applying patches for PJSIP installations that enable the remote payload-type map maintenance feature.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for PJSIP installations that enable the remote payload-type map maintenance feature.

Recommended defensive actions

  • Verify PJSIP installations for exposure, especially those enabling the remote payload-type map maintenance feature.
  • Apply patches for affected PJSIP installations.
  • Monitor for potential denial-of-service attacks.
  • Review and update inventory checks for PJSIP versions and configurations.
  • Perform vulnerability scanning to identify exposed systems.
  • Implement compensating controls for exposed systems while remediation is scheduled.
  • Track exceptions and retest remediated assets.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the patch. However, the corpus does not establish versions, exploitation, impact, or remediation for all affected systems.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-57159 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-57159

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-57159 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-57159

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.