CVE-2026-32942: Pjsip Use-After-Free Vulnerability

CVE-2026-32942 Overview

CVE-2026-32942 is a heap use-after-free vulnerability in PJSIP, an open source multimedia communication library written in C. The flaw exists in the Interactive Connectivity Establishment (ICE) session and is triggered by race conditions between session destruction and asynchronous callbacks. Versions 2.16 and below are affected. The maintainers fixed the issue in version 2.17. PJSIP is widely embedded in VoIP clients, softphones, WebRTC stacks, and SIP gateways, which expands the attack surface across telephony and real-time communication products. The vulnerability is tracked under [CWE-416] (Use After Free).

Critical Impact
A remote, unauthenticated attacker can exploit the race condition to access freed heap memory, potentially leading to memory corruption and arbitrary code execution in the context of the PJSIP-based application.

Affected Products

PJSIP pjproject versions 2.16 and earlier
Applications and softphones embedding the PJSIP ICE/PJNATH stack
VoIP and WebRTC gateways linking against vulnerable PJSIP builds

Discovery Timeline

2026-03-20 - CVE-2026-32942 published to NVD
2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-32942

Vulnerability Analysis

The vulnerability resides in the ICE session component of PJSIP, which manages NAT traversal for SIP and media negotiation. ICE sessions rely heavily on asynchronous callbacks driven by network events, STUN transactions, and connectivity checks. When the host application destroys an ICE session while these callbacks are still pending or executing, the underlying session memory can be freed before the callback finishes referencing it.

A subsequent callback then dereferences the dangling pointer, producing a classic heap use-after-free condition. Because the freed chunk can be reclaimed and reshaped by attacker-influenced data carried over SIP, STUN, or media transports, the bug provides a path from memory corruption to control-flow hijack in long-running services.

Root Cause

The root cause is missing synchronization between ICE session teardown and the lifetime of pending callbacks. The session structure is released without ensuring that all outstanding asynchronous events have completed or been cancelled. This violates the invariant that callback handlers require for safe access to the session context, matching the pattern described in [CWE-416].

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker who can deliver ICE/STUN traffic to a vulnerable endpoint, such as during call setup with a malicious SIP peer, can manipulate timing to race session destruction against incoming callbacks. Successful exploitation impacts confidentiality and integrity of the process memory. No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploitation code is published. Technical context is available in the GitHub Security Advisory GHSA-g88q-c2hm-q7p7 and the upstream fix commit.

Detection Methods for CVE-2026-32942

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linking libpjsip or libpjnath during or shortly after SIP/ICE call teardown.
Heap corruption signatures in core dumps referencing ICE session structures or STUN transaction callbacks.
Abnormal SIP signaling patterns showing rapid call setup and teardown from a single remote peer.

Detection Strategies

Inventory all software that statically or dynamically links PJSIP and compare versions against 2.17 using software composition analysis.
Run vulnerable builds under AddressSanitizer or Valgrind in pre-production to surface use-after-free reports on ICE teardown paths.
Correlate process crash telemetry with SIP/ICE traffic flows to identify probable exploitation attempts.

Monitoring Recommendations

Monitor SIP gateways and softphone servers for repeated unexpected process restarts tied to ICE negotiation.
Alert on inbound SIP INVITE storms from untrusted peers that trigger ICE candidate exchanges and abrupt session terminations.
Capture and retain crash dumps from PJSIP-based services for forensic analysis of suspected memory corruption events.

How to Mitigate CVE-2026-32942

Immediate Actions Required

Upgrade PJSIP/pjproject to version 2.17 or later across all builds and dependent applications.
Rebuild and redeploy any in-house software that statically links PJSIP after updating the dependency.
Restrict SIP and STUN exposure to trusted networks or peers until patching is complete.

Patch Information

The maintainers fixed the issue in PJSIP version 2.17. The corrective change is published in commit c9caceddabda7f18337b2a82d25d65f6224b450a and described in advisory GHSA-g88q-c2hm-q7p7. The fix synchronizes ICE session destruction with pending callbacks to prevent the dangling pointer access.

Workarounds

Disable ICE in PJSIP-based applications where NAT traversal is not required, reducing exposure to the affected code path.
Place vulnerable SIP endpoints behind a session border controller that terminates ICE and validates signaling.
Apply network-level access controls to limit who can initiate SIP/ICE sessions against affected services until the upgrade is deployed.

bash

# Configuration example: verify and upgrade pjproject
git clone https://github.com/pjsip/pjproject.git
cd pjproject
git checkout 2.17
./configure && make dep && make
sudo make install
ldconfig