Stack Buffer Overflow in PJSIP's SRTP/SDES Media Transport

CVE-2026-57162

What is CVE-2026-57162?

A stack buffer overflow vulnerability exists in the SRTP/SDES media transport of PJSIP when processing a=crypto attributes during SDP offer/answer. This issue arises from the manner in which a fixed-size array collects crypto attributes from remote SDP, allowing an adversary to send an excessive number of attributes that exceed the allocated array size. The overflow can lead to severe consequences such as unexpected application termination or even control flow hijack and memory corruption, as it is accessible during the SIP INVITE process before application-level authentication. Only applications that have SRTP enabled are affected, while those that do not enable SRTP remain secure. The vulnerability has been addressed in a patch made available in commit a1b707c.

References