CVE-2026-33069: PJSIP has an Out-of-bounds Read in SIP multipart parsing
PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a cascading out-of-bounds heap read in pjsipmultipartparse(). After boundary string matching, curptr is advanced past the delimiter without verifying it has not reached the buffer end. This allows 1-2 bytes of adjacent heap memory to be read. All applications that process incoming SIP messages with multipart bodies or SDP content are potentially affected. This issue is resolved in version 2.17.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33069?
CVE-2026-33069 is classified as a high severity vulnerability due to the risk of out-of-bounds reads, which can lead to potential information disclosure.
How do I fix CVE-2026-33069?
To fix CVE-2026-33069, upgrade PJSIP to version 2.17 or later, which addresses the out-of-bounds read issue.
Which versions of PJSIP are affected by CVE-2026-33069?
CVE-2026-33069 affects PJSIP versions 2.16 and below.
What kind of vulnerability is CVE-2026-33069?
CVE-2026-33069 is an out-of-bounds read vulnerability that occurs during SIP multipart parsing.
Is CVE-2026-33069 exploitable remotely?
Yes, CVE-2026-33069 can be exploited remotely if an attacker can send specially crafted SIP messages.