CVE-2026-41415: Teluu Pjsip Buffer Overflow Vulnerability

CVE-2026-41415 Overview

CVE-2026-41415 is an out-of-bounds read vulnerability affecting PJSIP, a free and open source multimedia communication library written in C. The vulnerability exists in versions 2.16 and earlier, where insufficient length validation during the parsing of malformed Content-ID URIs in SIP multipart message bodies can cause reads beyond the intended buffer bounds. This security issue has been classified as CWE-125 (Out-of-bounds Read) and is addressed in PJSIP version 2.17.

Critical Impact
Attackers can exploit this vulnerability remotely over the network by sending specially crafted SIP messages containing malformed Content-ID URIs, potentially causing service disruption or information disclosure through memory reads beyond buffer boundaries.

Affected Products

Teluu PJSIP versions 2.16 and earlier
Applications and VoIP systems built on the PJSIP library
SIP-based communication platforms using vulnerable PJSIP versions

Discovery Timeline

2026-04-24 - CVE-2026-41415 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41415

Vulnerability Analysis

This out-of-bounds read vulnerability occurs in the SIP multipart message handling code within PJSIP. When processing Content-ID (CID) URIs that are enclosed in angle brackets, the parser fails to properly validate the URI length before attempting to strip the brackets. Specifically, if a malformed URI contains only an opening angle bracket without sufficient content (length less than 2 characters), the code incorrectly adjusts the string pointer and length, resulting in reads beyond the allocated buffer boundaries.

The vulnerability can be triggered remotely without authentication by sending crafted SIP INVITE or other SIP messages containing malformed multipart bodies with invalid Content-ID headers. Successful exploitation could lead to denial of service through application crashes or potential information disclosure if sensitive memory contents are exposed.

Root Cause

The root cause is insufficient input validation in the sip_multipart.c file when handling Content-ID URIs. The original code assumes that any URI starting with an angle bracket < will have a minimum length to safely strip both the leading and trailing brackets. Without proper bounds checking, processing a URI like < (single character) causes the code to decrement the length by 2 and advance the pointer, resulting in an out-of-bounds memory access condition.

Attack Vector

The attack vector is network-based and requires no user interaction or authentication. An attacker can craft a SIP message with a malformed multipart body containing a Content-ID URI designed to trigger the out-of-bounds read. The attack flow involves:

Attacker constructs a SIP message (INVITE, MESSAGE, etc.) with multipart MIME body
The multipart body includes a Content-ID header with a malformed URI (e.g., a single < character)
Target PJSIP application receives and parses the message
The vulnerable code path is triggered during CID URI processing
Out-of-bounds read occurs, potentially crashing the application or leaking memory contents

    pj_size_t cid_len = pj_strlen(cid_uri);
    pj_size_t alloc_len = cid_len + 2 /* for the leading and trailing angle brackets */;
    pj_str_t uri_overlay;
-    pj_str_t cid_hdr;
+    pj_str_t cid_hdr = {0};
    pj_str_t hdr_overlay;

    pj_strassign(&uri_overlay, cid_uri);
    /* If the URI is already enclosed in angle brackets, remove them. */
    if (uri_overlay.ptr[0] == '<') {
+        if (uri_overlay.slen < 2)
+            return cid_hdr;
        uri_overlay.ptr++;
        uri_overlay.slen -= 2;
    }

Source: GitHub Commit

Detection Methods for CVE-2026-41415

Indicators of Compromise

Unexpected crashes or restarts of PJSIP-based applications during SIP message processing
Anomalous SIP messages containing malformed or unusually short Content-ID headers in multipart bodies
Memory access violations or segmentation faults logged by the application
SIP traffic containing multipart MIME bodies with suspicious Content-ID URIs starting with angle brackets

Detection Strategies

Deploy network intrusion detection rules to identify SIP messages with malformed Content-ID headers containing minimal content (e.g., single < character)
Implement application-level logging to capture and alert on SIP parsing errors related to multipart message handling
Monitor PJSIP application logs for unexpected crashes or memory access errors during message processing
Use deep packet inspection on SIP traffic to detect anomalous Content-ID URI patterns

Monitoring Recommendations

Enable verbose logging on SIP servers and endpoints to capture message parsing details
Set up alerting for repeated application crashes or restarts that may indicate exploitation attempts
Monitor network traffic for unusual SIP message patterns targeting multipart body processing
Implement runtime memory protection mechanisms to detect and prevent out-of-bounds access

How to Mitigate CVE-2026-41415

Immediate Actions Required

Upgrade PJSIP to version 2.17 or later, which contains the security fix
Review and inventory all applications using PJSIP library to identify affected deployments
Apply the security patch commit 4225a93c16661538005017883fbc8f1ea1d5f4b0 if immediate upgrade is not possible
Monitor PJSIP-based applications for signs of exploitation while applying updates

Patch Information

The vulnerability has been fixed in PJSIP version 2.17. The patch adds proper length validation before attempting to strip angle brackets from Content-ID URIs. The fix initializes the cid_hdr structure to zero and adds a bounds check that returns an empty structure if the URI length is less than 2 characters when it starts with an angle bracket. For detailed patch information, see the GitHub Security Advisory and the security patch commit.

Workarounds

Implement SIP message filtering at network boundary to reject messages with malformed Content-ID headers
Deploy a SIP-aware firewall or proxy that validates multipart message structure before forwarding
Consider implementing application-level input validation for SIP messages if source code modification is possible
Use network segmentation to limit exposure of vulnerable PJSIP deployments while patching

bash

# Configuration example
# Check current PJSIP version and update to patched release
# Verify installed version
pkg-config --modversion libpjproject

# Update to PJSIP 2.17 or later via package manager (example for Debian/Ubuntu)
sudo apt update && sudo apt install libpjproject-dev

# Or build from source with the security patch
git clone https://github.com/pjsip/pjproject.git
cd pjproject
git checkout 2.17
./configure && make dep && make && sudo make install