CVE-2026-29068: Pjsip Buffer Overflow Vulnerability

CVE-2026-29068 Overview

CVE-2026-29068 is a stack buffer overflow vulnerability affecting PJSIP, a widely-used free and open source multimedia communication library written in C. The vulnerability exists in the pjmedia-codec component when parsing RTP payloads that contain more frames than the caller-provided buffer can accommodate. This flaw allows remote attackers to trigger a denial of service condition by sending specially crafted RTP packets to vulnerable applications built with PJSIP.

Critical Impact
Remote attackers can exploit this stack buffer overflow to cause application crashes and denial of service in VoIP and multimedia communication systems utilizing PJSIP versions prior to 2.17.

Affected Products

PJSIP versions prior to 2.17
Applications and VoIP systems built using vulnerable PJSIP library versions
Multimedia communication platforms implementing pjmedia-codec for RTP processing

Discovery Timeline

2026-03-06 - CVE-2026-29068 published to NVD
2026-03-10 - Last updated in NVD database

Technical Details for CVE-2026-29068

Vulnerability Analysis

The vulnerability resides in the pjmedia-codec component of PJSIP, which handles Real-time Transport Protocol (RTP) payload parsing. When processing incoming RTP packets, the codec parser fails to properly validate the number of frames contained within the payload against the capacity of the caller-provided frame buffer. This boundary condition error allows an attacker to overflow the stack-allocated buffer by sending RTP payloads with an excessive number of frames.

As a network-accessible vulnerability requiring no authentication or user interaction, this flaw poses significant risk to exposed VoIP endpoints and multimedia gateways. The impact is primarily availability-focused, enabling attackers to crash affected applications and disrupt communication services.

Root Cause

The root cause is classified as CWE-121 (Stack-based Buffer Overflow). The pjmedia-codec parsing functions do not perform adequate bounds checking when copying frame data from incoming RTP payloads into the stack buffer provided by the calling function. When an RTP packet contains more frames than the buffer was allocated to hold, the excess data overwrites adjacent stack memory, leading to memory corruption and application crashes.

Attack Vector

Exploitation occurs over the network without requiring any privileges or user interaction. An attacker can craft malicious RTP packets containing an abnormally high number of frames and send them to a target system running a PJSIP-based application. The attack flow includes:

The attacker identifies a target system using PJSIP for VoIP or multimedia communications
Malicious RTP packets are crafted with frame counts exceeding expected buffer sizes
When the vulnerable pjmedia-codec processes these packets, the stack buffer overflow is triggered
The overflow corrupts stack memory, causing application termination or undefined behavior

The vulnerability mechanism involves insufficient validation in the frame parsing logic. When pjmedia-codec receives an RTP payload, it iterates through the contained frames and copies them into a caller-provided buffer without verifying the frame count against buffer capacity. For technical details on the fix, refer to the GitHub Security Advisory GHSA-pqww-jrxr-457f.

Detection Methods for CVE-2026-29068

Indicators of Compromise

Unexpected crashes or restarts of PJSIP-based VoIP applications
Core dumps or crash logs indicating stack corruption in pjmedia-codec functions
Abnormal RTP traffic patterns with unusually large or malformed payloads
Increased network activity from unknown sources targeting RTP ports

Detection Strategies

Deploy network intrusion detection rules to identify malformed RTP packets with excessive frame counts
Monitor PJSIP application logs for segmentation faults or buffer overflow-related errors
Implement deep packet inspection on RTP traffic to detect anomalous payload structures
Use memory protection tools to detect stack corruption attempts in real-time

Monitoring Recommendations

Enable verbose logging in PJSIP applications to capture RTP parsing errors
Configure alerting for application crashes affecting VoIP infrastructure components
Monitor system stability metrics for PJSIP-dependent services
Establish baselines for normal RTP traffic patterns to identify anomalies

How to Mitigate CVE-2026-29068

Immediate Actions Required

Upgrade all PJSIP installations to version 2.17 or later immediately
Audit all applications and systems using PJSIP to identify vulnerable deployments
Implement network segmentation to restrict RTP traffic to trusted sources where possible
Enable stack protection mechanisms (e.g., stack canaries) at the compiler level if rebuilding from source

Patch Information

The PJSIP maintainers have addressed this vulnerability in version 2.17. The fix implements proper bounds checking in the pjmedia-codec RTP payload parsing functions to ensure frame counts do not exceed buffer capacity. Organizations should upgrade to the patched version as soon as possible. The security patch is available via the GitHub commit.

Workarounds

Deploy network-level filtering to block malformed RTP packets before reaching vulnerable applications
Use a Web Application Firewall (WAF) or similar technology capable of RTP inspection
Temporarily disable or restrict access to RTP endpoints from untrusted networks
Consider implementing rate limiting on RTP traffic to reduce attack surface

bash

# Example: iptables rules to restrict RTP traffic to known sources
# Replace 10.0.0.0/8 with your trusted network range
iptables -A INPUT -p udp --dport 10000:20000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 10000:20000 -j DROP