← Vulnerability feed

Vulnerability record · CVE-2026-57159 · published 4 September 2026

CVE-2026-57159: Teluu pjsip out-of-bounds write vulnerability

Teluu · Pjsip

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c uses payload-type numbers taken from a remote SDP offer or answer to index fixed-size internal tables without sufficient bounds validation, so a crafted remote SDP can cause memory access outside those tables. The practical impact is memory corruption and denial of service; code execution is not demonstrated. This path is only reached when PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP is enabled. The default is disabled, so default builds are not affected; the feature is an interoperability option that integrating products may enable. This issue has been patched via commit 673b978.

8.4 CVSS 4.0 High EPSS 0.60% · top 53.6% CWE-129 · CWE-129CWE-787 · Out-of-bounds write
8.4CVSS 4.0 base score
0.60%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
11 Sep 2026Last modified by NVD

Description

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c uses payload-type numbers taken from a remote SDP offer or answer to index fixed-size internal tables without sufficient bounds validation, so a crafted remote SDP can cause memory access outside those tables. The practical impact is memory corruption and denial of service; code execution is not demonstrated. This path is only reached when PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP is enabled. The default is disabled, so default builds are not affected; the feature is an interoperability option that integrating products may enable. This issue has been patched via commit 673b978.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pjsip/pjproject/commit/673b978aab1fe3ab874247be32c871acc880cbeb Patch
https://github.com/pjsip/pjproject/security/advisories/GHSA-rfwg-w9gq-9mw2 PatchVendor Advisory

Track CVE-2026-57159 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-38703Teluu pjsip use after free vulnerabilityPJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is …EPSS 1.3%9.8CVE-2022-23537Teluu pjsip heap-based buffer overflow vulnerabilityPJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, S…EPSS 1.0%9.8CVE-2022-31031Teluu pjsip classic buffer overflow vulnerabilityPJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, S…EPSS 2.0%9.8CVE-2022-24754Teluu pjsip classic buffer overflow vulnerabilityPJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stac…EPSS 2.1%9.8CVE-2022-23608Teluu pjsip use after free vulnerabilityPJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, S…EPSS 4.0%9.8CVE-2021-43299Teluu pjsip stack-based buffer overflow vulnerabilityStack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copi…EPSS 2.5%9.8CVE-2021-43300Teluu pjsip stack-based buffer overflow vulnerabilityStack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is co…EPSS 2.4%9.8CVE-2021-43301Teluu pjsip stack-based buffer overflow vulnerabilityStack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-controlled 'file_names' argument may cause a buffer overflow since it is …EPSS 2.4%

Source: NIST National Vulnerability Database (record CVE-2026-57159), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.