CVE-2026-57162: PJSIP: Stack overflow parsing SDP a=crypto attributes
PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer (sdesencodesdp() in transportsrtpsdes.c). This affects applications with SRTP enabled (usesrtp optional or mandatory, using SDES keying). During media negotiation, the crypto attributes from the remote SDP are collected into a fixed-size array without bounding their number; a remote peer that includes an excessive number of a=crypto attributes in a single media description can write past the end of that array on the stack. This is reachable from an incoming SIP INVITE during offer/answer, before application-level authentication. Impact may range from unexpected application termination to control flow hijack/memory corruption. Applications that do not enable SRTP are not affected. This issue has been patched via commit a1b707c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PJSIPto a version that resolves this vulnerability.Patch a1b707c
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using PJSIP with SRTP enabled in either optional or mandatory mode and using SDES keying are affected. Applications that do not enable SRTP are not affected.
What does an attacker need to exploit it?
An attacker needs to send an incoming SIP INVITE that reaches SDP offer/answer negotiation and contains an excessive number of a=crypto attributes in one media description. The issue is reachable before application-level authentication.
How can I determine whether my application is vulnerable?
Review whether SRTP is enabled and configured to use SDES keying, then determine whether the PJSIP source includes commit a1b707c. Affected code collects remote SDP crypto attributes into a fixed-size array without limiting their number.
What should be done to remediate the issue?
Apply the patch provided in commit a1b707c. If immediate patching is not possible, disabling SRTP removes the affected code path, though this changes media-security behavior.