CVE-2026-57162: Teluu Pjsip SRTP Buffer Overflow Vulnerability

CVE-2026-57162 Overview

CVE-2026-57162 is a stack buffer overflow in PJSIP, an open source multimedia communication library written in C. The flaw resides in the sdes_encode_sdp() function within transport_srtp_sdes.c and affects applications that enable Secure Real-time Transport Protocol (SRTP) using Session Description Protocol Security Descriptions (SDES) keying. A remote attacker can trigger the overflow through a single SIP INVITE containing an excessive number of a=crypto attributes. Exploitation occurs during Session Description Protocol (SDP) offer/answer negotiation, before any application-level authentication. The issue was patched in commit a1b707c.

Critical Impact
A remote, unauthenticated peer can corrupt stack memory during SIP media negotiation, leading to application termination or potential control-flow hijack in any PJSIP-based softphone, PBX, or SIP gateway with SRTP enabled.

Affected Products

Teluu PJSIP (pjproject) versions prior to commit a1b707c
Applications built on PJSIP with SRTP enabled (use_srtp optional or mandatory) using SDES keying
SIP endpoints, softphones, and gateways linking vulnerable PJSIP builds

Discovery Timeline

2026-09-04 - CVE-2026-57162 published to the National Vulnerability Database
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-57162

Vulnerability Analysis

The vulnerability is a classic stack-based buffer overflow [CWE-121] in PJSIP's SRTP/SDES transport layer. During SDP offer/answer processing, sdes_encode_sdp() collects a=crypto attributes from the remote media description into a fixed-size stack array named tags[]. The SDP parser caps the total attribute count at PJMEDIA_MAX_SDP_ATTR, which is larger than the capacity of tags[]. Because the code did not bound writes against PJ_ARRAY_SIZE(tags), a remote peer can supply more crypto attributes than the array can hold. The excess entries overwrite adjacent stack memory, including saved registers and return addresses on many architectures.

Root Cause

The root cause is missing bounds validation between two independent limits. The SDP parser enforces PJMEDIA_MAX_SDP_ATTR on incoming attributes, while the SRTP consumer assumed a much smaller maximum for crypto tags. Without a guard comparing cr_attr_count to PJ_ARRAY_SIZE(tags) before indexing, the loop writes past the array boundary.

Attack Vector

An attacker sends a single SIP INVITE that contains a media description packed with more a=crypto lines than the tags[] array can hold. Because SIP endpoints process offer/answer negotiation prior to authenticating the caller, exploitation requires no credentials and no user interaction. Any PJSIP-based service reachable over the network with SRTP negotiation enabled is exposed. Applications that do not enable SRTP are not affected.

                has_crypto_attr = PJ_TRUE;

+               /* Bound writes to tags[] by its capacity. m_rem->attr_count
+                * is capped by the SDP parser at PJMEDIA_MAX_SDP_ATTR, which
+                * can exceed PJ_ARRAY_SIZE(tags); without this guard a remote
+                * peer can overflow the stack array by sending more than
+                * PJ_ARRAY_SIZE(tags) a=crypto attributes.
+                */
+               if (cr_attr_count >= PJ_ARRAY_SIZE(tags))
+                   return PJMEDIA_SRTP_ESDPINCRYPTO;
+
                status = parse_attr_crypto(srtp->pool, m_rem->attr[i],
                                           &tmp_rx_crypto,
                                           &tags[cr_attr_count]);

Source: pjproject commit a1b707c — the patch adds a capacity check that returns PJMEDIA_SRTP_ESDPINCRYPTO before writing past the tags[] array.

Detection Methods for CVE-2026-57162

Indicators of Compromise

Inbound SIP INVITE messages containing an unusually high number of a=crypto attributes in a single media description.
Unexpected crashes, segmentation faults, or restarts of PJSIP-based processes shortly after receiving SIP traffic.
Core dumps referencing sdes_encode_sdp or parse_attr_crypto frames in transport_srtp_sdes.c.

Detection Strategies

Inspect SIP traffic at the border and count a=crypto lines per SDP media section, alerting when the count exceeds the vendor default (typically fewer than 10).
Correlate PJSIP process crash telemetry with preceding INVITE traffic from the same remote endpoint.
Track software bill of materials (SBOM) data to identify applications linking PJSIP builds prior to commit a1b707c.

Monitoring Recommendations

Enable verbose SIP transport logging on PJSIP servers to capture full SDP payloads for forensic review.
Monitor SIP INVITE volume and payload size anomalies from untrusted sources.
Deploy VoIP-aware intrusion detection signatures that flag oversized crypto attribute lists in SDP offers.

How to Mitigate CVE-2026-57162

Immediate Actions Required

Upgrade PJSIP to a build that includes commit a1b707c or later.
Inventory all applications, PBXs, and gateways that statically or dynamically link PJSIP and schedule redeployment.
Restrict SIP INVITE processing to trusted peers using session border controllers (SBCs) or firewall access control lists until patches are applied.

Patch Information

The fix is available in the upstream pjproject repository as commit a1b707c. Refer to the GitHub Security Advisory GHSA-m9g3-jcj8-qjfm for the coordinated disclosure details and the patch commit for the source change. Downstream distributions and application vendors that bundle PJSIP should rebuild against the fixed commit and issue updated binaries.

Workarounds

Disable SRTP negotiation (use_srtp = PJMEDIA_SRTP_DISABLED) if secure media is not required in your deployment.
Terminate SIP traffic through an SBC that normalizes or drops SDP media descriptions containing excessive a=crypto attributes.
Apply strict network segmentation so PJSIP-based services accept SIP signaling only from authenticated upstream proxies.

bash

# Rebuild PJSIP from source with the fix applied
git clone https://github.com/pjsip/pjproject.git
cd pjproject
git checkout a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9
./configure && make dep && make
sudo make install