← Vulnerability feed

Vulnerability record · CVE-2026-41416 · published 24 April 2026

CVE-2026-41416: Teluu pjsip integer overflow vulnerability

Teluu · Pjsip

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an integer overflow in media stream buffer size calculation when processing SDP with asymmetric ptime configuration. The overflow may result in an undersized buffer allocation, which can lead to unexpected application termination or memory corruption This vulnerability is fixed in 2.17.

8.1 CVSS 4.0 High EPSS 0.49% · top 60.5% CWE-190 · Integer overflow
8.1CVSS 4.0 base score
0.49%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an integer overflow in media stream buffer size calculation when processing SDP with asymmetric ptime configuration. The overflow may result in an undersized buffer allocation, which can lead to unexpected application termination or memory corruption This vulnerability is fixed in 2.17.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pjsip/pjproject/commit/66fe416c96e957417621b7be16e9e587d159f9bb Patch
https://github.com/pjsip/pjproject/security/advisories/GHSA-f33g-8hjq-62xr PatchVendor Advisory

Track CVE-2026-41416 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-38703Teluu pjsip use after free vulnerabilityPJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is …EPSS 1.3%9.8CVE-2022-23537Teluu pjsip heap-based buffer overflow vulnerabilityPJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, S…EPSS 1.0%9.8CVE-2022-31031Teluu pjsip classic buffer overflow vulnerabilityPJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, S…EPSS 2.0%9.8CVE-2022-24754Teluu pjsip classic buffer overflow vulnerabilityPJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stac…EPSS 2.1%9.8CVE-2022-23608Teluu pjsip use after free vulnerabilityPJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, S…EPSS 4.0%9.8CVE-2021-43299Teluu pjsip stack-based buffer overflow vulnerabilityStack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copi…EPSS 2.5%9.8CVE-2021-43300Teluu pjsip stack-based buffer overflow vulnerabilityStack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is co…EPSS 2.4%9.8CVE-2021-43301Teluu pjsip stack-based buffer overflow vulnerabilityStack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-controlled 'file_names' argument may cause a buffer overflow since it is …EPSS 2.4%

Source: NIST National Vulnerability Database (record CVE-2026-41416), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.