CVE-2026-41416: PJSIP: Asymmetric ptime integer overflow in Media Stream
PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an integer overflow in media stream buffer size calculation when processing SDP with asymmetric ptime configuration. The overflow may result in an undersized buffer allocation, which can lead to unexpected application termination or memory corruption This vulnerability is fixed in 2.17.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41416?
CVE-2026-41416 is a high severity vulnerability due to the potential for integer overflow leading to buffer overflows.
How do I fix CVE-2026-41416?
To fix CVE-2026-41416, upgrade to version 2.17 or later of the PJSIP library.
What software is affected by CVE-2026-41416?
CVE-2026-41416 affects PJSIP versions 2.16 and earlier.
What are the consequences of CVE-2026-41416?
CVE-2026-41416 may lead to crashes or arbitrary code execution due to the flawed media stream buffer size calculation.
How can I mitigate CVE-2026-41416 if I cannot upgrade?
If upgrading is not possible, consider implementing strict input validation to avoid exploiting the integer overflow.