CVE-2026-57159: Teluu Pjsip SDP Negotiator DOS Vulnerability

CVE-2026-57159 Overview

CVE-2026-57159 is a remote out-of-bounds read and write vulnerability in PJSIP, an open source multimedia communication library written in C. The flaw resides in the Session Description Protocol (SDP) negotiator when the remote payload-type map maintenance feature is enabled. A crafted remote SDP offer or answer can trigger memory corruption and denial of service in integrating products.

The issue is tracked under [CWE-129] Improper Validation of Array Index and was fixed in commit 673b978.

Critical Impact
A remote attacker sending a crafted SDP message can cause out-of-bounds memory access, leading to memory corruption and denial of service in applications that enable PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP. Code execution has not been demonstrated.

Affected Products

Teluu PJSIP versions prior to commit 673b978
PJSIP builds with PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP enabled
Integrating products that ship PJSIP with the interoperability option turned on

Discovery Timeline

2026-09-04 - CVE-2026-57159 published to the National Vulnerability Database
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-57159

Vulnerability Analysis

The vulnerability lives in assign_pt_and_update_map() inside pjmedia/src/pjmedia/sdp_neg.c. The function accepts payload-type (PT) numbers parsed from a remote SDP offer or answer and uses them directly as indexes into fixed-size internal tables. Because PT values are not validated against the bounds of the dynamic PT map, an attacker-controlled value outside the expected range causes reads and writes past the end of those arrays.

The practical result is memory corruption in the SDP negotiator state and a denial-of-service condition in the SIP/media stack. The upstream advisory states that arbitrary code execution has not been demonstrated. The affected code path only runs when PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP is enabled, which is off in default builds. Integrators enabling the option for peer interoperability inherit the risk.

Root Cause

The root cause is missing bounds validation on payload-type indexes derived from remote input. PJSIP defines codec_to_pt_map as a fixed-size pj_int8_t array sized by PJMEDIA_CODEC_MGR_MAX_CODECS, and PT values are expected to fall inside the dynamic range START_DYNAMIC_PT..127. Prior to the patch, no helper enforced that constraint before indexing.

Attack Vector

Exploitation is network-based and requires no authentication. An attacker delivers a malformed SDP body inside a SIP INVITE, 200 OK, or other message carrying media negotiation. When the vulnerable build processes the message, the crafted PT value drives an out-of-bounds access.

 /* Array for mapping codec ID to PT number. */
 typedef pj_int8_t codec_to_pt_map[PJMEDIA_CODEC_MGR_MAX_CODECS];

+/* Check whether a payload type is a dynamic PT that fits in the map,
+ * i.e. in the range START_DYNAMIC_PT..127. Payload numbers parsed from
+ * remote SDP attributes must be validated with this before being used as
+ * an index into the fixed-size dynamic PT map arrays.
+ */
+PJ_INLINE(pj_bool_t) is_dynamic_pt(unsigned pt)
+{
+    return pt >= START_DYNAMIC_PT && pt < START_DYNAMIC_PT + DYNAMIC_PT_SIZE;
+}
+
 /**
  * This structure describes SDP media negotiator.
  */

Source: PJSIP commit 673b978. The patch introduces is_dynamic_pt() and gates array indexing on that check.

Detection Methods for CVE-2026-57159

Indicators of Compromise

Unexpected crashes or restarts of SIP softphones, PBXs, or media gateways during call setup or renegotiation
SDP payloads containing rtpmap or fmtp attributes referencing payload-type values outside the dynamic range (below 96 or above 127)
Repeated malformed INVITE or 200 OK messages from the same remote peer targeting media negotiation

Detection Strategies

Inspect SIP traffic at the session border controller or SIP proxy for SDP bodies with out-of-range PT values in a=rtpmap: lines
Correlate PJSIP process crashes with inbound SIP signaling from external peers
Audit build flags of deployed applications for PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP to identify exposed instances

Monitoring Recommendations

Enable verbose logging on PJSIP-based services to capture SDP negotiation errors and abnormal PT values
Forward SIP signaling logs and process crash telemetry to a centralized data lake for correlation
Alert on repeated abnormal call termination patterns tied to a single remote endpoint

How to Mitigate CVE-2026-57159

Immediate Actions Required

Update PJSIP to a build that includes commit 673b978 or later
Inventory all applications embedding PJSIP and confirm whether PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP is enabled
Restrict SIP signaling exposure to trusted peers through session border controllers or firewalls while patching

Patch Information

The upstream fix is available in the PJSIP repository via commit 673b978aab1fe3ab874247be32c871acc880cbeb. Vendor details are published in GitHub Security Advisory GHSA-rfwg-w9gq-9mw2 and the upstream commit. Rebuild dependent products against the patched source and redeploy.

Workarounds

Disable PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP at compile time if the interoperability feature is not required
Terminate untrusted SIP traffic at a proxy that normalizes SDP and strips out-of-range payload types
Apply access control lists to limit inbound SIP to known partners until the patched binary is deployed

bash

# Rebuild PJSIP with the default (safe) configuration
git clone https://github.com/pjsip/pjproject.git
cd pjproject
git checkout 673b978aab1fe3ab874247be32c871acc880cbeb
# Ensure the interop flag remains disabled in config_site.h
# (do NOT define PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP)
./configure && make dep && make