CVE-2026-57165 Overview
CVE-2026-57165 is a stack buffer overflow [CWE-121] in PJSIP, an open source multimedia communication library written in C. The flaw resides in the PJLIB-UTIL telnet command-line interface (CLI) front-end, specifically the handle_up_down() function in cli_telnet.c. When a user recalls a history entry, the line-redraw sequence can accumulate more data than the fixed-size stack buffer PJ_CLI_MAX_CMDBUF holds. This may cause application termination. Only applications that enable the telnet CLI front-end are affected. The issue was patched in commit 628b716.
Critical Impact
Attackers with access to the unauthenticated telnet CLI can trigger a stack buffer overflow through history recall, potentially terminating the host application.
Affected Products
- Teluu PJSIP (pjproject) prior to commit 628b716
- Applications built on PJLIB-UTIL that enable the telnet CLI front-end
- Downstream projects embedding vulnerable PJSIP versions
Discovery Timeline
- 2026-09-04 - CVE-2026-57165 published to the National Vulnerability Database (NVD)
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-57165
Vulnerability Analysis
The vulnerability exists in the telnet CLI front-end of PJLIB-UTIL, a support library within the PJSIP project. When a user navigates command history via the up or down arrow keys, handle_up_down() builds a redraw sequence that clears the current line and writes the recalled history entry. The function allocates a stack buffer of size PJ_CLI_MAX_CMDBUF to hold this sequence.
The redraw sequence can accumulate up to cur_pos + 2 * rcmd->len + history->slen bytes. When these terms combine, the resulting data exceeds the fixed-size buffer, corrupting adjacent stack memory. The likely outcome is process termination through stack corruption detection or an invalid memory access.
Exploitation requires access to the telnet CLI, which is unauthenticated in PJSIP's default configuration and already permits arbitrary CLI commands. The additional impact beyond existing CLI access is therefore limited to availability.
Root Cause
The root cause is an unchecked size assumption in handle_up_down() inside pjlib-util/src/pjlib-util/cli_telnet.c. The original code assumed a single PJ_CLI_MAX_CMDBUF-sized buffer was sufficient for the redraw sequence, without validating that the sum of the cursor position, twice the current buffer length, and the history entry length would fit.
Attack Vector
An attacker with network access to the exposed telnet CLI port connects to the service, enters or triggers commands to populate history, then issues up-arrow or down-arrow control sequences to recall a history entry sized to overflow the redraw buffer. No authentication is required when the telnet CLI front-end is enabled.
// Patch excerpt from pjlib-util/src/pjlib-util/cli_telnet.c
history = get_prev_history(sess, is_up);
if (history) {
pj_str_t send_data;
- char str[PJ_CLI_MAX_CMDBUF];
+ /* The redraw sequence can accumulate up to
+ * cur_pos + 2 * rcmd->len + history->slen
+ * bytes, each term bounded by PJ_CLI_MAX_CMDBUF, so size the
+ * local buffer for the worst case and clamp each term below.
+ */
+ char str[PJ_CLI_MAX_CMDBUF * 4];
+ unsigned cur_pos, buf_len;
+ pj_size_t hist_len;
enum {
MOVE_CURSOR_LEFT = 0x08,
CLEAR_CHAR = 0x20
};
send_data.ptr = str;
send_data.slen = 0;
+ cur_pos = sess->rcmd->cur_pos;
+ buf_len = sess->rcmd->len;
+ hist_len = history->slen;
+ if (cur_pos > PJ_CLI_MAX_CMDBUF)
+ cur_pos = PJ_CLI_MAX_CMDBUF;
+ if (buf_len > PJ_CLI_MAX_CMDBUF)
+ buf_len = PJ_CLI_MAX_CMDBUF;
+ if (hist_len > PJ_CLI_MAX_CMDBUF)
+ hist_len = PJ_CLI_MAX_CMDBUF;
+
/* Move cursor position to the beginning of line */
Source: PJSIP commit 628b716
Detection Methods for CVE-2026-57165
Indicators of Compromise
- Unexpected termination or crash logs for applications embedding PJSIP with telnet CLI enabled.
- Inbound TCP connections to the PJSIP telnet CLI port from untrusted networks.
- Core dumps showing stack corruption inside handle_up_down() or cli_telnet.c frames.
Detection Strategies
- Inventory dependencies to identify applications linking against PJSIP versions prior to commit 628b716.
- Inspect build configurations for the telnet CLI front-end being enabled and exposed on a network interface.
- Review process crash telemetry for repeated failures correlated with telnet session activity.
Monitoring Recommendations
- Log all connections and command activity to the PJSIP telnet CLI service and alert on unexpected sources.
- Monitor for repeated arrow-key control sequences or unusually long history entries in telnet session captures.
- Track application restart and crash counts on hosts running PJSIP-based services.
How to Mitigate CVE-2026-57165
Immediate Actions Required
- Update PJSIP to a build that includes commit 628b716 and redeploy dependent applications.
- Disable the PJLIB-UTIL telnet CLI front-end in production builds unless it is operationally required.
- Restrict network access to the telnet CLI port to trusted management interfaces only.
Patch Information
The vulnerability is fixed in PJSIP commit 628b716. The patch increases the local redraw buffer to PJ_CLI_MAX_CMDBUF * 4 and clamps each contributing term (cur_pos, buf_len, hist_len) to PJ_CLI_MAX_CMDBUF before assembling the redraw sequence. Refer to the GitHub Security Advisory GHSA-rpq9-9fx7-95xw and the upstream commit for details.
Workarounds
- Compile PJSIP without the telnet CLI front-end when it is not needed operationally.
- Bind the telnet CLI to loopback (127.0.0.1) only and require SSH tunneling for remote access.
- Enforce firewall rules that restrict inbound access to the CLI port to a management VLAN.
# Example firewall rule restricting PJSIP telnet CLI access to a management subnet
iptables -A INPUT -p tcp --dport 2323 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2323 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
