Stack Buffer Overflow Vulnerability in PJSIP Multimedia Communication Library

CVE-2026-40892

What is CVE-2026-40892?

A stack buffer overflow vulnerability has been identified in the PJSIP multimedia communication library for versions 2.16 and earlier. This vulnerability arises within the function pjsip_auth_create_digest2(), where the library improperly handles credential data length when using pre-computed digest credentials. Specifically, the function copies data into a fixed-size buffer (128 bytes) without proper upper-bound checking, allowing for potential overflow if the provided credential length exceeds the intended limits. This flaw could lead to unexpected behavior or security exploitations. Developers and users are encouraged to review the related security advisories and upgrade to the latest version to mitigate risk.

References