Heap-based Buffer Overflow in PJSIP Open Source Multimedia Communication Library
CVE-2026-32945
Key Information:
Badges
What is CVE-2026-32945?
The PJSIP multimedia communication library has a vulnerability related to a heap-based buffer overflow in the DNS parser's name length handler. This issue impacts applications using PJSIP's integrated DNS resolver, which is configured through pjsua_config.nameserver or UaConfig.nameserver settings. Users benefiting from the operating system’s resolver without specific name server configurations, or those utilizing an external resolver, remain unaffected. The vulnerability is addressed in PJSIP version 2.17. For those unable to upgrade, disabling DNS resolution by setting nameserver_count to zero or employing an external DNS resolver is recommended as a temporary workaround.
Affected Version(s)
pjproject < 2.17
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.