CVE-2026-28799: Pjsip Use-After-Free Vulnerability

CVE-2026-28799 Overview

CVE-2026-28799 is a heap use-after-free vulnerability affecting PJSIP, a free and open source multimedia communication library written in C. The vulnerability exists in PJSIP's event subscription framework (evsub.c) and is triggered during presence unsubscription operations when processing SUBSCRIBE requests with Expires=0. This memory corruption flaw can be exploited remotely over the network without requiring authentication or user interaction.

Critical Impact

Remote attackers can exploit this heap use-after-free vulnerability to cause denial of service conditions in applications using PJSIP for VoIP and multimedia communications. The vulnerability affects the core SIP event subscription handling, making any PJSIP-based application potentially vulnerable.

Affected Products

• PJSIP versions prior to 2.17
• Applications and VoIP systems built on PJSIP library
• SIP-based communication platforms utilizing PJSIP event subscription framework

Discovery Timeline

• 2026-03-06 - CVE-2026-28799 published to NVD
• 2026-03-10 - Last updated in NVD database

Technical Details for CVE-2026-28799

Vulnerability Analysis

This use-after-free vulnerability occurs in the event subscription framework of PJSIP, specifically within the evsub.c component. The flaw is triggered when handling presence unsubscription requests—SIP SUBSCRIBE messages that include an Expires=0 header to terminate an existing subscription. During the unsubscription process, memory associated with the subscription state may be freed prematurely while still being referenced by other parts of the code, leading to a classic use-after-free condition.

The vulnerability is classified under CWE-416 (Use After Free), indicating that the program continues to use a pointer after the memory it references has been deallocated. In the context of PJSIP, this occurs during the complex state management required for SIP event subscriptions, where timing issues between subscription termination and ongoing notification handling can lead to accessing freed memory.

Root Cause

The root cause stems from improper memory lifecycle management in the event subscription state machine. When a SUBSCRIBE request with Expires=0 initiates an unsubscription, the subscription object may be deallocated before all pending operations referencing it have completed. The fix introduces a deferred_state_notify flag to properly handle TERMINATED state notifications, ensuring that subscription state is not prematurely freed while notification callbacks may still be executing.

Attack Vector

An attacker can exploit this vulnerability remotely over the network by sending specially crafted SIP SUBSCRIBE messages with Expires=0 to a target PJSIP-based application. The attack requires no prior authentication or special privileges, making it accessible to any network-adjacent or internet-facing attacker. The exploitation can result in denial of service through application crashes caused by accessing freed heap memory.

// Security patch introducing deferred state notification handling
// Source: https://github.com/pjsip/pjproject/commit/e06ff6c64741cc1675fd3296615910f532f6b1a1

    pj_timer_entry       *pending_sub_timer; /**< Stop pending sub timer.   */
    pjsip_tx_data        *pending_notify;/**< Pending NOTIFY to be sent.    */
    pj_bool_t             calling_on_rx_refresh;/**< Inside on_rx_refresh()?*/
+   pj_bool_t             deferred_state_notify;/**< Deferred TERMINATED notify */
    pj_grp_lock_t        *grp_lock;     /* Session group lock       */

    void                 *mod_data[PJSIP_MAX_MODULE];   /**< Module data.   */

Source: GitHub Commit Details

Detection Methods for CVE-2026-28799

Indicators of Compromise

• Unexpected application crashes or segmentation faults in PJSIP-based services following SIP SUBSCRIBE operations
• Memory corruption errors in logs associated with evsub.c or event subscription handling
• Abnormal patterns of SUBSCRIBE requests with Expires=0 from suspicious sources
• Core dumps showing freed memory access in event subscription callback functions

Detection Strategies

• Monitor SIP traffic for unusual patterns of SUBSCRIBE requests with Expires=0 headers, particularly from untrusted sources
• Implement memory debugging tools (AddressSanitizer, Valgrind) in development and staging environments to detect use-after-free conditions
• Deploy network intrusion detection rules to identify potential exploitation attempts targeting SIP event subscription endpoints
• Enable verbose logging for PJSIP event subscription handling to capture anomalous unsubscription sequences

Monitoring Recommendations

• Configure application-level monitoring to alert on unexpected service restarts or crashes in VoIP/SIP infrastructure
• Establish baseline metrics for SUBSCRIBE/NOTIFY transaction patterns and alert on deviations
• Monitor memory allocation patterns in PJSIP processes for signs of heap corruption

How to Mitigate CVE-2026-28799

Immediate Actions Required

• Upgrade PJSIP to version 2.17 or later, which contains the security patch for this vulnerability
• Conduct an inventory of all applications and services utilizing PJSIP to identify affected deployments
• Implement network segmentation to limit exposure of PJSIP-based services to untrusted networks
• Review firewall rules to restrict SIP traffic to known, authorized endpoints where possible

Patch Information

The vulnerability has been patched in PJSIP version 2.17. The fix introduces a deferred_state_notify boolean flag in the subscription structure to properly manage the timing of TERMINATED state notifications, preventing premature memory deallocation. Organizations should apply this update immediately to all affected systems. For detailed patch information, refer to the GitHub Security Advisory and the commit details.

Workarounds

• Implement rate limiting on SUBSCRIBE requests to reduce potential exploitation impact
• Deploy a SIP-aware firewall or application layer gateway to filter malformed or suspicious SUBSCRIBE messages
• Consider temporarily disabling presence/subscription functionality if not critical to operations until patching is complete

# Example: Update PJSIP to patched version
git clone https://github.com/pjsip/pjproject.git
cd pjproject
git checkout 2.17
./configure && make dep && make
sudo make install