CVE-2026-57161: Teluu PJSIP Buffer Overflow Vulnerability

CVE-2026-57161 Overview

CVE-2026-57161 is a stack buffer overflow [CWE-121] in PJSIP, an open-source multimedia communication library written in C. The flaw resides in the update_service_route() function in pjsua_acc.c and affects applications using the PJSUA and PJSUA2 account APIs. When PJSUA processes a 2xx response to a SIP REGISTER request, it stores Service-Route header URIs into a fixed-size stack array without bounding the number of headers. A registrar returning excessive Service-Route headers can write past the end of the array.

Critical Impact
A malicious or compromised SIP registrar can trigger a stack buffer overflow in PJSUA clients, causing application termination or potential memory corruption during account registration.

Affected Products

Teluu PJSIP (pjproject) versions prior to commit acc03b5
Applications using the PJSUA account API (default registration path)
Applications using the PJSUA2 account API

Discovery Timeline

2026-09-04 - CVE-2026-57161 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-57161

Vulnerability Analysis

The vulnerability exists in PJSIP's SIP registration handling logic. When a client sends a REGISTER request and receives a 2xx success response, PJSUA parses any Service-Route headers in the response and stores the URIs into a fixed-size local array on the stack. The original loop terminated only when the linked list of headers was exhausted or when the array was full, but the fill check occurred inside the loop condition rather than before writing.

The values written past the array bounds are internal URI pointers from parsed SIP headers rather than attacker-controlled bytes. This constrains the exploit primitive: the most probable outcome is application termination through stack corruption. Broader memory corruption cannot be excluded on all platforms and toolchains.

Root Cause

The root cause is missing bounds validation before writing to a fixed-size stack buffer in update_service_route(). The loop wrote a URI pointer to uri[uri_cnt++] and then checked bounds in the while condition, allowing one write past the end of the array when the header list exceeded PJ_ARRAY_SIZE(uri). This matches the pattern of [CWE-121: Stack-based Buffer Overflow].

Attack Vector

Exploitation requires a client to register against a malicious or compromised SIP registrar that returns a crafted 2xx REGISTER response containing an excessive number of Service-Route headers. Over unprotected SIP transports such as UDP or plaintext TCP, a network attacker can also spoof the registrar response. No authentication or user interaction with the PJSIP client is required beyond initiating the standard registration flow.

// Patch from commit acc03b5 - pjsip/src/pjsua-lib/pjsua_acc.c
                return;
            }

+           if (uri_cnt >= PJ_ARRAY_SIZE(uri)) {
+               PJ_LOG(1,(THIS_FILE, "Error: too many Service-Route headers"));
+               return;
+           }
+
            uri[uri_cnt++] = h->name_addr.uri;
            h = h->next;
-       } while (h != hr && uri_cnt != PJ_ARRAY_SIZE(uri));
-
-       if (h != hr) {
-           PJ_LOG(1,(THIS_FILE, "Error: too many Service-Route headers"));
-           return;
-       }
+       } while (h != hr);

        /* Prepare to find next Service-Route header */
        hsr = hsr->next;

Source: PJSIP commit acc03b5

Detection Methods for CVE-2026-57161

Indicators of Compromise

Unexpected crashes or aborts of PJSUA/PJSUA2-based softphones or VoIP applications immediately after sending a REGISTER request.
SIP 200 OK responses to REGISTER containing an unusually large number of Service-Route headers.
Log entries containing the string Error: too many Service-Route headers from patched builds, indicating attempted exploitation.

Detection Strategies

Inspect SIP registrar responses at the network boundary for Service-Route header counts exceeding typical values (usually 1–2).
Monitor process crash telemetry on VoIP endpoints and servers built with PJSIP for stack corruption signatures near update_service_route.
Correlate registration failures with subsequent client restarts to identify potential DoS activity against SIP endpoints.

Monitoring Recommendations

Enable SIP transport security (TLS) so that only trusted registrars can generate responses reaching the client parser.
Log outbound REGISTER destinations and validate that clients only register against approved registrars.
Capture SIP traffic during troubleshooting to preserve evidence of malformed responses for forensic review.

How to Mitigate CVE-2026-57161

Immediate Actions Required

Rebuild PJSIP-based applications from source that includes commit acc03b5 or later from the pjproject repository.
Restrict client registrations to trusted SIP registrars and disable registration against arbitrary or user-supplied SIP URIs.
Enforce SIP over TLS (sips: scheme) to eliminate spoofed REGISTER responses on the network path.

Patch Information

The vulnerability is patched in PJSIP commit acc03b57cef7a7d31b8e1f5b9117437d7e87c591. The fix adds an explicit bounds check on uri_cnt before writing to the fixed-size uri array in update_service_route(). Additional details are available in the GitHub Security Advisory GHSA-xc62-j9h2-mp84.

Workarounds

Where source patching is not immediately possible, restrict outbound SIP registration traffic to allow-listed registrars via firewall rules.
Disable automatic account registration in PJSUA/PJSUA2 applications until a patched build is deployed.
Enable TLS transport for SIP signaling to prevent unauthenticated network attackers from injecting spoofed registrar responses.

bash

# Verify PJSIP source is at or beyond the fix commit
cd pjproject
git log --oneline acc03b57cef7a7d31b8e1f5b9117437d7e87c591 -1

# Rebuild PJSIP after checkout of a patched revision
git checkout acc03b57cef7a7d31b8e1f5b9117437d7e87c591
./configure && make dep && make clean && make