CVE-2026-77396: PJSIP Buffer Overflow Vulnerability

CVE-2026-77396 Overview

CVE-2026-77396 is a heap-based out-of-bounds write [CWE-122] in the PJSIP multimedia communication library. The flaw resides in the AVI parser at pjmedia/src/pjmedia/avi_player.c and affects PJSIP versions 2.17 and earlier. The parser trusts the video chunk length declared inside an AVI file and copies that many bytes into a frame buffer sized from the file's declared media dimensions. A crafted AVI file can therefore trigger a write past the heap allocation when an application plays the file or pulls its frames.

Critical Impact
Attackers who supply a malicious AVI file to a PJSIP-based application can corrupt heap memory, crash the process, or potentially achieve code execution in applications that accept untrusted AVI sources.

Affected Products

PJSIP (pjproject) version 2.17
PJSIP (pjproject) versions prior to 2.17
Applications embedding the PJSIP pjmedia AVI player component

Discovery Timeline

2026-09-18 - CVE-2026-77396 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-77396

Vulnerability Analysis

The defect lives in the AVI playback path inside avi_player.c. When PJSIP reads a video chunk from an AVI container, it passes the chunk length (ch.len) directly to file_read3() as the number of bytes to copy into frame->buf. The buffer capacity (frame->size) is computed from the video width and height declared earlier in the same file. Both values are attacker controlled and are not cross validated at runtime.

A pj_assert(frame->size >= ch.len) call precedes the read, but PJSIP assertions compile to no-ops in release builds. Production deployments therefore execute the copy without any length check, producing a heap out-of-bounds write whose size is bounded only by the 32-bit chunk length field.

Root Cause

The root cause is missing input validation between two attacker-influenced values from the same file. The parser treats the AVI header dimensions as ground truth for allocation and treats the per-chunk length as ground truth for the copy, with no reconciliation between the two. Relying on pj_assert() to enforce the invariant is unsafe because release builds strip assertions.

Attack Vector

Exploitation requires an application to open or stream a crafted AVI file through PJSIP's media player. User interaction is required, typically in the form of loading or playing the file. Local playback usually results in a process crash. Applications that accept AVI content from untrusted network sources face a stronger memory corruption condition that may lead to code execution in the context of the host process.

                goto on_error2;
            fport->size_left -= size_to_read;
        } else {
-            pj_assert(frame->size >= ch.len);
-            status = file_read3(fport->fd, frame->buf, ch.len,
+            pj_uint32_t read_len = ch.len;
+
+            /* Clamp the read to the frame buffer capacity. A crafted
+             * file may declare a chunk larger than the buffer, whose
+             * size is derived from the (also file-supplied) video
+             * dimensions; never write past frame->buf (frame->size
+             * bytes). Do not rely on pj_assert() here, as it is a no-op
+             * in release builds.
+             */
+            if (read_len > frame->size) {
+                PJ_LOG(3, (THIS_FILE,
+                           "AVI video chunk (%u) exceeds frame buffer "
+                           "(%u), truncating",
+                           (unsigned)ch.len, (unsigned)frame->size));
+                read_len = (pj_uint32_t)frame->size;
+            }
+
+            status = file_read3(fport->fd, frame->buf, read_len,
                                0, &size_read);
            if (status != PJ_SUCCESS)
                goto on_error2;
-            frame->size = ch.len;
+
+            /* Skip any remaining chunk bytes that did not fit, so the
+             * file position stays aligned to the next chunk.

Source: PJSIP GitHub Commit 7ecc658. The patch replaces the assertion with a runtime clamp of read_len to frame->size and skips leftover chunk bytes so the file position remains aligned to the next chunk.

Detection Methods for CVE-2026-77396

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linked against libpjmedia while opening or streaming AVI content.
Heap corruption diagnostics from allocator hardening features (glibc malloc abort messages, MALLOC_CHECK_, or AddressSanitizer reports) originating in avi_player.c.
AVI files whose declared per-chunk length exceeds the buffer implied by the file's video width, height, and pixel format.

Detection Strategies

Run PJSIP-based softphones and media servers under AddressSanitizer or Valgrind in test environments to catch out-of-bounds writes on suspicious AVI samples.
Add a preprocessing step that parses AVI headers and rejects files where any movi chunk length exceeds the frame buffer size computed from the stream header dimensions.
Hunt for SIGSEGV or SIGABRT exits of PJSIP-based services correlated with recent inbound AVI transfers.

Monitoring Recommendations

Log all AVI files ingested by PJSIP applications, including source, size, and declared dimensions, for post-incident review.
Monitor process telemetry from softphones, PBX gateways, and IVR services for abnormal termination or memory-integrity events.
Track upstream pjproject releases and security advisories for a fixed version referencing GHSA-6p2p-5wf8-h5hr.

How to Mitigate CVE-2026-77396

Immediate Actions Required

Inventory all applications that link libpjmedia or ship PJSIP 2.17 or earlier and identify those that expose AVI playback to untrusted input.
Disable AVI playback features in exposed applications until a patched build is deployed.
Restrict AVI file ingestion to trusted sources and validate files with a hardened parser before handing them to PJSIP.

Patch Information

No fixed release of PJSIP is available as of this review. The upstream fix is tracked in the commit at PJSIP GitHub Commit 7ecc658 and the advisory GHSA-6p2p-5wf8-h5hr. Vendors integrating PJSIP should backport the commit, which clamps read_len to frame->size and skips remaining chunk bytes to preserve file alignment.

Workarounds

Backport the upstream patch into local PJSIP builds and enforce compiler and allocator hardening flags such as -D_FORTIFY_SOURCE=2 and heap protectors.
Sandbox PJSIP media processing in a low-privilege process or container to contain the impact of memory corruption.
Compile PJSIP with assertions enabled in production only as a temporary defense, understanding that assertions abort the process rather than provide a durable fix.

bash

# Build PJSIP from source with the upstream fix applied
git clone https://github.com/pjsip/pjproject.git
cd pjproject
git cherry-pick 7ecc6584969a923c4190b6912afbf5952b5a4b9f
export CFLAGS="-O2 -D_FORTIFY_SOURCE=2 -fstack-protector-strong"
./configure && make dep && make
sudo make install