CVE-2026-33069: PJSIP Information Disclosure Vulnerability

CVE-2026-33069 Overview

CVE-2026-33069 is an out-of-bounds heap read vulnerability in PJSIP, a free and open source multimedia communication library written in C. The vulnerability exists in the pjsip_multipart_parse() function where improper boundary checking allows 1-2 bytes of adjacent heap memory to be read after boundary string matching operations.

Critical Impact

All applications processing incoming SIP messages with multipart bodies or SDP content are potentially affected, enabling attackers to read sensitive heap memory contents via malformed SIP messages.

Affected Products

• PJSIP versions 2.16 and below
• Applications using PJSIP for SIP message processing
• VoIP and multimedia communication systems built on PJSIP

Discovery Timeline

• 2026-03-20 - CVE CVE-2026-33069 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-33069

Vulnerability Analysis

This out-of-bounds heap read vulnerability occurs in the multipart parsing logic of PJSIP. The issue stems from improper validation of the buffer pointer position after advancing past a boundary delimiter. When parsing multipart SIP messages, the code advances the curptr pointer past the delimiter without first verifying that it has not exceeded the buffer boundary (endptr). This oversight allows the code to read 1-2 bytes beyond the allocated heap buffer when processing specially crafted SIP messages.

The vulnerability can be triggered remotely by sending malformed SIP messages with manipulated multipart body boundaries. While the information disclosure is limited to 1-2 bytes per exploitation attempt, repeated exploitation could potentially leak more sensitive heap data. The network-accessible nature of this vulnerability makes it a concern for any internet-facing SIP infrastructure.

Root Cause

The root cause is a missing bounds check in pjsip/src/pjsip/sip_multipart.c. After the boundary string is matched and curptr is advanced past the delimiter, the code immediately attempts to dereference and check the character values without first confirming that curptr still points within the valid buffer range. This creates a race between pointer advancement and boundary validation, resulting in a CWE-125 (Out-of-bounds Read) condition.

Attack Vector

An attacker can exploit this vulnerability by sending specially crafted SIP messages with malformed multipart boundaries to a vulnerable PJSIP application. The attack vector is network-based, requiring no authentication or user interaction. By manipulating the boundary strings in multipart SIP messages, an attacker can cause the parser to read beyond the allocated heap buffer, potentially disclosing sensitive memory contents.

The following patch demonstrates the security fix applied in version 2.17:

 
         /* Eat the boundary */
         curptr += delim.slen;
-        if (*curptr=='-' && curptr<endptr-1 && *(curptr+1)=='-') {
+        if (curptr+1 < endptr && *curptr=='-' && *(curptr+1)=='-') {
             /* Found the closing delimiter */
             curptr += 2;
             break;
         }
         /* Optional whitespace after delimiter */
         while (curptr!=endptr && IS_SPACE(*curptr)) ++curptr;
         /* Mandatory CRLF */
+        if (curptr == endptr) {
+            PJ_LOG(2, (THIS_FILE, "Unexpected end of buffer after boundary"));
+            return NULL;
+        }
         if (*curptr=='\r') ++curptr;
-        if (*curptr!='\n') {
+        if (curptr == endptr || *curptr!='\n') {
             /* Expecting a newline here */
             PJ_LOG(2, (THIS_FILE, "Failed to find newline"));
 

Source: GitHub Commit Details

Detection Methods for CVE-2026-33069

Indicators of Compromise

• Unusual SIP messages with malformed or truncated multipart boundaries arriving at SIP endpoints
• Application crashes or unexpected behavior in SIP message parsing routines
• Memory access violations or heap corruption errors in PJSIP-based applications
• Abnormal traffic patterns targeting SIP services with high volumes of malformed requests

Detection Strategies

• Monitor SIP traffic for messages containing abnormal multipart body structures or truncated boundaries
• Implement application-level logging in PJSIP to capture parsing errors and boundary validation failures
• Deploy network intrusion detection signatures for malformed SIP multipart messages
• Use memory sanitizers (AddressSanitizer, Valgrind) during testing to detect out-of-bounds reads

Monitoring Recommendations

• Enable detailed logging for SIP message parsing failures and boundary validation errors
• Monitor heap memory access patterns in PJSIP applications for anomalous read operations
• Set up alerts for increased rates of SIP message parsing failures
• Track application stability metrics for PJSIP-based services to identify potential exploitation attempts

How to Mitigate CVE-2026-33069

Immediate Actions Required

• Upgrade PJSIP to version 2.17 or later which contains the security fix
• Review and audit any applications using PJSIP for multipart SIP message processing
• Implement input validation at the network perimeter for SIP traffic
• Consider deploying a SIP-aware firewall or application gateway to filter malformed messages

Patch Information

The vulnerability is resolved in PJSIP version 2.17. The fix adds proper bounds checking before accessing buffer contents after boundary string matching. Organizations should upgrade to version 2.17 or apply the security patch available at the GitHub Commit Details. For additional details, refer to the GitHub Security Advisory.

Workarounds

• Implement network-level filtering to drop malformed SIP messages before they reach vulnerable applications
• Deploy a SIP proxy or application-layer gateway that validates multipart message structure
• Restrict SIP service exposure to trusted networks only until patching is complete

# Configuration example
# Example: Restrict SIP service to trusted networks using iptables
iptables -A INPUT -p udp --dport 5060 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 5060 -j DROP
iptables -A INPUT -p tcp --dport 5060 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 5060 -j DROP