CVE-2026-29068: Pjsip Buffer Overflow Vulnerability

CVE-2026-29068 Overview

CVE-2026-29068 is a stack buffer overflow vulnerability affecting PJSIP, a widely-used free and open source multimedia communication library written in C. The vulnerability exists in the pjmedia-codec component when parsing RTP payloads that contain more frames than the caller-provided buffer can accommodate. This flaw allows remote attackers to trigger a denial of service condition by sending specially crafted RTP packets to vulnerable applications built with PJSIP.

Critical Impact

Remote attackers can exploit this stack buffer overflow to cause application crashes and denial of service in VoIP and multimedia communication systems utilizing PJSIP versions prior to 2.17.

Affected Products

• PJSIP versions prior to 2.17
• Applications and VoIP systems built using vulnerable PJSIP library versions
• Multimedia communication platforms implementing pjmedia-codec for RTP processing

Discovery Timeline

• 2026-03-06 - CVE-2026-29068 published to NVD
• 2026-03-10 - Last updated in NVD database

Technical Details for CVE-2026-29068

Vulnerability Analysis

The vulnerability resides in the pjmedia-codec component of PJSIP, which handles Real-time Transport Protocol (RTP) payload parsing. When processing incoming RTP packets, the codec parser fails to properly validate the number of frames contained within the payload against the capacity of the caller-provided frame buffer. This boundary condition error allows an attacker to overflow the stack-allocated buffer by sending RTP payloads with an excessive number of frames.

As a network-accessible vulnerability requiring no authentication or user interaction, this flaw poses significant risk to exposed VoIP endpoints and multimedia gateways. The impact is primarily availability-focused, enabling attackers to crash affected applications and disrupt communication services.

Root Cause

The root cause is classified as CWE-121 (Stack-based Buffer Overflow). The pjmedia-codec parsing functions do not perform adequate bounds checking when copying frame data from incoming RTP payloads into the stack buffer provided by the calling function. When an RTP packet contains more frames than the buffer was allocated to hold, the excess data overwrites adjacent stack memory, leading to memory corruption and application crashes.

Attack Vector

Exploitation occurs over the network without requiring any privileges or user interaction. An attacker can craft malicious RTP packets containing an abnormally high number of frames and send them to a target system running a PJSIP-based application. The attack flow includes:

1. The attacker identifies a target system using PJSIP for VoIP or multimedia communications
2. Malicious RTP packets are crafted with frame counts exceeding expected buffer sizes
3. When the vulnerable pjmedia-codec processes these packets, the stack buffer overflow is triggered
4. The overflow corrupts stack memory, causing application termination or undefined behavior

The vulnerability mechanism involves insufficient validation in the frame parsing logic. When pjmedia-codec receives an RTP payload, it iterates through the contained frames and copies them into a caller-provided buffer without verifying the frame count against buffer capacity. For technical details on the fix, refer to the GitHub Security Advisory GHSA-pqww-jrxr-457f.

Detection Methods for CVE-2026-29068

Indicators of Compromise

• Unexpected crashes or restarts of PJSIP-based VoIP applications
• Core dumps or crash logs indicating stack corruption in pjmedia-codec functions
• Abnormal RTP traffic patterns with unusually large or malformed payloads
• Increased network activity from unknown sources targeting RTP ports

Detection Strategies

• Deploy network intrusion detection rules to identify malformed RTP packets with excessive frame counts
• Monitor PJSIP application logs for segmentation faults or buffer overflow-related errors
• Implement deep packet inspection on RTP traffic to detect anomalous payload structures
• Use memory protection tools to detect stack corruption attempts in real-time

Monitoring Recommendations

• Enable verbose logging in PJSIP applications to capture RTP parsing errors
• Configure alerting for application crashes affecting VoIP infrastructure components
• Monitor system stability metrics for PJSIP-dependent services
• Establish baselines for normal RTP traffic patterns to identify anomalies

How to Mitigate CVE-2026-29068

Immediate Actions Required

• Upgrade all PJSIP installations to version 2.17 or later immediately
• Audit all applications and systems using PJSIP to identify vulnerable deployments
• Implement network segmentation to restrict RTP traffic to trusted sources where possible
• Enable stack protection mechanisms (e.g., stack canaries) at the compiler level if rebuilding from source

Patch Information

The PJSIP maintainers have addressed this vulnerability in version 2.17. The fix implements proper bounds checking in the pjmedia-codec RTP payload parsing functions to ensure frame counts do not exceed buffer capacity. Organizations should upgrade to the patched version as soon as possible. The security patch is available via the GitHub commit.

Workarounds

• Deploy network-level filtering to block malformed RTP packets before reaching vulnerable applications
• Use a Web Application Firewall (WAF) or similar technology capable of RTP inspection
• Temporarily disable or restrict access to RTP endpoints from untrusted networks
• Consider implementing rate limiting on RTP traffic to reduce attack surface

# Example: iptables rules to restrict RTP traffic to known sources
# Replace 10.0.0.0/8 with your trusted network range
iptables -A INPUT -p udp --dport 10000:20000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 10000:20000 -j DROP