CVE-2026-40892: PJSIP Buffer Overflow Vulnerability

CVE-2026-40892 Overview

PJSIP, a free and open source multimedia communication library written in C, contains a critical stack buffer overflow vulnerability in version 2.16 and earlier. The flaw exists in the pjsip_auth_create_digest2() function when using pre-computed digest credentials (PJSIP_CRED_DATA_DIGEST). The function copies credential data using cred_info->data.slen as the length without performing an upper-bound check, which can overflow the fixed-size ha1 stack buffer (128 bytes) if data.slen exceeds the expected digest string length. This vulnerability could allow remote attackers to execute arbitrary code or cause denial of service on affected systems.

Critical Impact

Remote attackers can exploit this stack buffer overflow to potentially achieve code execution or crash applications using PJSIP for SIP/VoIP communications by providing malicious credential data that exceeds the 128-byte stack buffer limit.

Affected Products

• PJSIP versions 2.16 and earlier
• Applications integrating PJSIP library for SIP communications
• VoIP and multimedia communication systems using vulnerable PJSIP versions

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-40892 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-40892

Vulnerability Analysis

This vulnerability is classified as CWE-121: Stack-based Buffer Overflow. The flaw resides in the authentication mechanism of PJSIP, specifically within the pjsip_auth_create_digest2() function. When the library processes pre-computed digest credentials (indicated by the PJSIP_CRED_DATA_DIGEST flag), it copies credential data into a fixed-size stack buffer without proper bounds validation.

The ha1 buffer is allocated on the stack with a fixed size of 128 bytes, which is designed to hold MD5 or SHA-256 digest strings. However, the copy operation uses cred_info->data.slen (the actual length of the credential data) without checking if this length exceeds the buffer capacity. An attacker who can control the credential data length can provide input exceeding 128 bytes, overwriting adjacent stack memory including return addresses and saved registers.

This vulnerability is network-accessible and requires no authentication or user interaction to exploit, making it particularly dangerous for internet-facing SIP services.

Root Cause

The root cause is a missing upper-bound length check before copying credential data into the fixed-size ha1 stack buffer. The vulnerable code path trusts the cred_info->data.slen value without validating it against the buffer's capacity of 128 bytes. This represents a classic C programming error where buffer sizes are assumed rather than enforced, allowing memory corruption when input exceeds expectations.

Attack Vector

The attack vector is network-based, exploitable remotely without authentication. An attacker can craft malicious SIP authentication requests containing credential data with a length value (slen) exceeding 128 bytes. When the PJSIP library processes these credentials using the PJSIP_CRED_DATA_DIGEST mode, the oversized data overflows the stack buffer. This can corrupt the stack frame, potentially allowing the attacker to hijack program execution flow, execute arbitrary code, or cause application crashes.

The exploitation scenario involves sending specially crafted SIP REGISTER or INVITE requests with malformed authentication headers to a target SIP endpoint using the vulnerable PJSIP library.

Detection Methods for CVE-2026-40892

Indicators of Compromise

• Unexpected crashes or segmentation faults in applications using PJSIP during SIP authentication
• Abnormally large SIP authentication headers or digest credential data in network traffic
• Memory corruption signatures or stack smashing detection alerts from compiled applications
• Unusual SIP requests with credential data exceeding 128 bytes in length

Detection Strategies

• Monitor SIP traffic for authentication requests containing abnormally large credential payloads
• Implement network intrusion detection rules to flag SIP messages with digest data exceeding 128 bytes
• Enable stack protection mechanisms (ASLR, stack canaries) and monitor for stack smashing detections
• Review application logs for authentication-related crashes or memory errors in PJSIP-based services

Monitoring Recommendations

• Deploy network-based monitoring for SIP protocol anomalies targeting authentication mechanisms
• Configure application crash monitoring and core dump analysis for PJSIP-based services
• Implement real-time alerting for memory corruption indicators in VoIP infrastructure
• Monitor for reconnaissance activity targeting SIP endpoints and authentication endpoints

How to Mitigate CVE-2026-40892

Immediate Actions Required

• Update PJSIP to a patched version containing commit c82123ea6f3c3652bbc9ebd5e9e658c301451687
• If immediate patching is not possible, disable pre-computed digest authentication mode (PJSIP_CRED_DATA_DIGEST)
• Implement network-level filtering to block SIP requests with oversized credential data
• Enable additional memory protection mechanisms such as stack canaries and ASLR for applications using PJSIP

Patch Information

The vulnerability has been addressed in the official PJSIP repository. The fix is available in commit c82123ea6f3c3652bbc9ebd5e9e658c301451687. Organizations should update to the latest PJSIP release that includes this security fix. For detailed information about the vulnerability and remediation, refer to the GitHub Security Advisory and the patch commit.

Workarounds

• Avoid using PJSIP_CRED_DATA_DIGEST credential mode until patching is complete
• Implement input validation at the application layer to reject oversized credential data before processing
• Deploy Web Application Firewalls or SIP-aware firewalls to filter malformed authentication requests
• Isolate PJSIP-based services in network segments with restricted access from untrusted sources

# Update PJSIP to the latest patched version
git clone https://github.com/pjsip/pjproject.git
cd pjproject
git checkout c82123ea6f3c3652bbc9ebd5e9e658c301451687
./configure && make dep && make
sudo make install