CVE-2026-32945: PJSIP is vulnerable to Heap-based Buffer Overflow through DNS parser
PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a Heap-based Buffer Overflowvulnerability in the DNS parser's name length handler. Thisimpacts applications using PJSIP's built-in DNS resolver, such as those configured with pjsuaconfig.nameserver or UaConfig.nameserver in PJSUA/PJSUA2. It does not affect users who rely on the OS resolver (e.g., getaddrinfo()) by not configuring a nameserver, or those using an external resolver via pjsipresolversetextresolver(). This issue is fixed in version 2.17. For users unable to upgrade, a workaround is to disable DNS resolution in the PJSIP config (by setting nameservercount to zero) or to use an external resolver implementation instead.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32945?
CVE-2026-32945 has a high severity rating due to its ability to cause a heap-based buffer overflow.
How do I fix CVE-2026-32945?
To fix CVE-2026-32945, upgrade to PJSIP version 2.17 or later, which contains the necessary patches.
What systems are affected by CVE-2026-32945?
CVE-2026-32945 affects all PJSIP versions 2.16 and below that utilize the DNS parser.
What are the potential impacts of CVE-2026-32945?
CVE-2026-32945 can lead to application crashes or arbitrary code execution due to the buffer overflow.
Is CVE-2026-32945 publicly known?
Yes, CVE-2026-32945 is publicly disclosed and documented in security advisories.