CVE-2026-57159: PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assignptandupdatemap() in pjmedia/src/pjmedia/sdpneg.c uses payload-type numbers taken from a remote SDP offer or answer to index fixed-size internal tables without sufficient bounds validation, so a crafted remote SDP can cause memory access outside those tables. The practical impact is memory corruption and denial of service; code execution is not demonstrated. This path is only reached when PJMEDIASDPNEGMAINTAINREMOTEPTMAP is enabled. The default is disabled, so default builds are not affected; the feature is an interoperability option that integrating products may enable. This issue has been patched via commit 673b978.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PJSIPto a version that resolves this vulnerability.Patch commit 673b978 - Configuration
Ensure PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP is disabled, since the out-of-bounds condition is only reachable when this feature is enabled.
PJSIP pjmedia SDP negotiator PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP = disabled
Event History
Frequently Asked Questions
Which deployments are affected?
Only builds with PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP enabled are affected. The option is disabled by default, but integrating products may enable it for interoperability.
What does an attacker need to exploit this issue?
An attacker needs to supply a crafted remote SDP offer or answer to a vulnerable SDP negotiator with remote payload-type map maintenance enabled. The malformed payload-type values are used to index fixed-size internal tables without adequate bounds checks.
What is the known impact?
The issue can cause out-of-bounds reads and writes, resulting in memory corruption and denial of service. Code execution has not been demonstrated.
What should teams do if they use the optional feature?
Apply the fix in commit 673b978. If patching is not immediately possible, disable PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP where feasible.
How can I determine whether my build is exposed?
Check whether PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP is enabled in the PJSIP build or integrating product configuration. Also verify whether commit 673b978 has been incorporated.