CVE-2026-57166: Teluu PJSIP Buffer Overflow Vulnerability

CVE-2026-57166 Overview

CVE-2026-57166 is a stack buffer overflow [CWE-121] in PJSIP, an open source multimedia communication library written in C. The flaw resides in the PJLIB-UTIL telnet command-line interface (CLI) front-end. Several command-line handling paths write attacker-influenced data into fixed-size stack buffers without sufficient bounds checking. A long or malformed command line can overflow those buffers while the CLI renders feedback, leading to application termination. The issue only affects applications that enable the telnet CLI front-end through pj_cli_telnet_create() or the --cli-telnet-port option. The maintainers patched the defect in commit 4472a31.

Critical Impact
Any network client able to reach the unauthenticated PJSIP telnet CLI can send an overly long command line to crash the host application via stack buffer overflow.

Affected Products

Teluu PJSIP (pjproject) versions prior to commit 4472a31
PJLIB-UTIL telnet CLI front-end (pj_cli_telnet_create())
Applications exposing the telnet CLI via --cli-telnet-port

Discovery Timeline

2026-09-04 - CVE-2026-57166 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-57166

Vulnerability Analysis

PJSIP ships an optional telnet-based administration interface built on the PJLIB-UTIL CLI framework. When a connected client submits a command, the CLI parser echoes and renders feedback for the entered command line. Multiple code paths in that rendering logic copy the raw command line into fixed-size stack buffers. The copies rely on the assumption that input length stays within expected CLI bounds, which the telnet front-end does not enforce.

When the input exceeds the buffer size, the copy overwrites adjacent stack memory. Overflow of the return address or saved frame pointer terminates the process. Because the telnet CLI is intended as an interactive administration tool, it has no authentication layer. Any client that can open a TCP connection to the CLI port can already run arbitrary CLI commands, so the incremental impact of this defect is limited to availability loss of the host application.

Root Cause

The root cause is missing bounds validation on command-line data before it is written into fixed-size stack buffers inside the PJLIB-UTIL telnet CLI feedback-rendering code paths. This falls under [CWE-121] Stack-based Buffer Overflow.

Attack Vector

Exploitation requires network reachability to the port on which the vulnerable application exposes pj_cli_telnet_create(). The attacker opens a telnet session and submits a single overly long command line. The CLI feedback path overflows a stack buffer during rendering and the process terminates. No prior authentication is required because the telnet CLI has none.

No verified public exploit code is available for CVE-2026-57166. Refer to the GitHub Security Advisory GHSA-9c8q-h38q-p85j and the upstream patch commit 4472a31 for technical details.

Detection Methods for CVE-2026-57166

Indicators of Compromise

Unexpected termination or crash of PJSIP-based applications shortly after inbound TCP connections to the configured CLI telnet port.
Core dumps or crash reports showing corrupted stack frames inside PJLIB-UTIL CLI functions.
Telnet CLI sessions originating from unexpected source addresses outside administrative networks.

Detection Strategies

Inventory deployed PJSIP builds and identify any that call pj_cli_telnet_create() or set --cli-telnet-port.
Compare linked PJSIP library commit hashes against the fixed commit 4472a31 to flag vulnerable binaries.
Monitor process supervisors (systemd, launchd, container orchestrators) for repeated restart events of PJSIP-based services.

Monitoring Recommendations

Log all TCP connections and byte counts to the CLI telnet port and alert on abnormally large single-line payloads.
Ingest application crash telemetry into a centralized platform to correlate crashes with inbound CLI traffic.
Alert on any exposure of the CLI telnet port on interfaces reachable from untrusted networks.

How to Mitigate CVE-2026-57166

Immediate Actions Required

Update PJSIP to a build that includes commit 4472a31 or later.
If patching is not immediately possible, disable the telnet CLI front-end by not calling pj_cli_telnet_create() and removing --cli-telnet-port from startup arguments.
Restrict network access to any active CLI telnet port to trusted administrative hosts using host firewalls or network ACLs.

Patch Information

The defect is fixed upstream in pjproject commit 4472a31. The fix adds bounds checking on command-line data written to fixed-size stack buffers in the PJLIB-UTIL telnet CLI feedback paths. Downstream distributors of PJSIP should rebuild and redistribute their packages against this commit or a later release. See GHSA-9c8q-h38q-p85j for the vendor advisory.

Workarounds

Do not enable the telnet CLI front-end in production deployments; use an out-of-band administration channel instead.
Bind the CLI telnet listener to 127.0.0.1 and require operators to connect through an authenticated jump host or SSH tunnel.
Enforce strict firewall rules that permit inbound connections to the CLI port only from known management IP ranges.

bash

# Configuration example: restrict CLI telnet port to loopback and block external access
# Example iptables rule blocking external access to a PJSIP CLI telnet port (e.g., 2323)
iptables -A INPUT -p tcp --dport 2323 ! -s 127.0.0.1 -j DROP

# Preferred: launch the PJSIP application without the telnet CLI front-end
# Remove any --cli-telnet-port argument and avoid calling pj_cli_telnet_create() in code