CVE-2026-57159: PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assignptandupdatemap() in pjmedia/src/pjmedia/sdpneg.c uses payload-type numbers taken from a remote SDP offer or answer to index fixed-size internal tables without sufficient bounds validation, so a crafted remote SDP can cause memory access outside those tables. The practical impact is memory corruption and denial of service; code execution is not demonstrated. This path is only reached when PJMEDIASDPNEGMAINTAINREMOTEPTMAP is enabled. The default is disabled, so default builds are not affected; the feature is an interoperability option that integrating products may enable. This issue has been patched via commit 673b978.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PJSIPto a version that resolves this vulnerability.Fixed in prior to commit 673b978Patch 673b978 - Configuration
Ensure PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP is disabled, since the remote out-of-bounds read/write occurs when the payload-type map maintenance feature is enabled.
PJSIP (PJMEDIA SDP negotiator) PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP = disabled - Compensating control
If you must enable PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP for interoperability, restrict access so untrusted parties cannot send crafted remote SDP offers/answers to the SDP negotiator (e.g., limit who can reach the signaling interface that triggers assign_pt_and_update_map()).
Event History
Frequently Asked Questions
Which deployments are affected?
Only builds with PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP enabled are affected. The option is disabled by default, but integrating products may enable it for interoperability.
What does an attacker need to exploit this issue?
An attacker needs to supply a crafted remote SDP offer or answer to a vulnerable SDP negotiator with remote payload-type map maintenance enabled. The malformed payload-type values are used to index fixed-size internal tables without adequate bounds checks.
What is the known impact?
The issue can cause out-of-bounds reads and writes, resulting in memory corruption and denial of service. Code execution has not been demonstrated.
What should teams do if they use the optional feature?
Apply the fix in commit 673b978. If patching is not immediately possible, disable PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP where feasible.
How can I determine whether my build is exposed?
Check whether PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP is enabled in the PJSIP build or integrating product configuration. Also verify whether commit 673b978 has been incorporated.