CVE-2026-57162 pjsip CVE debrief

Who should care

Defenders responsible for PJSIP-based applications, particularly those using SRTP, should assess exposure and apply the patch to prevent potential application termination or control flow hijack/memory corruption.

Why it matters

Defenders should prioritize verifying and applying the patch to prevent potential application termination or control flow hijack/memory corruption in PJSIP-based applications using SRTP.

• Potential application termination due to stack buffer overflow
• Possible control flow hijack or memory corruption
• Verification of patch application is necessary to prevent exploitation
• SRTP-enabled applications are at risk and require immediate attention

Technical summary

The vulnerability exists in the sdes_encode_sdp() function in transport_srtp_sdes.c. A remote peer can write past the end of a fixed-size array on the stack by including an excessive number of a=crypto attributes in a single media description. This affects applications with SRTP enabled. During media negotiation, the crypto attributes from the remote SDP are collected into a fixed-size array without bounding their number; a remote peer that includes an excessive number of a=crypto attributes in a single media description can write past the end of that array on the stack. Impact may range from unexpected application termination to control flow hijack/memory corruption.

Defensive priority

Defenders should prioritize verifying and applying the patch to prevent potential application termination or control flow hijack/memory corruption.

Recommended defensive actions

• Verify and apply the patch via commit a1b707c
• Review and update affected applications to ensure SRTP is properly configured
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by a stack buffer overflow in the sdes_encode_sdp() function in transport_srtp_sdes.c. This occurs when a remote peer includes an excessive number of a=crypto attributes in a single media description.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.