CVE-2026-57160

    Dashboard / Vulnerabilities / CVE-2026-57160

    CVE-2026-57160

    Published: 4 Sept 2026Last Modified: 13 Sept 2026

    Summary: PJSIP: SIP message header buffer overflow

    Details: PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c, the function that serializes generic array headers (such as Allow, Require, Supported, and Unsupported). Under certain output-buffer boundary conditions the function can write one byte past the end of the buffer. This is reachable mainly in applications that parse and re-serialize incoming SIP requests — for example a proxy, SBC, or B2BUA — where a remote peer can influence the serialized message. The out-of-bounds write is a single fixed byte; code execution and information disclosure are not demonstrated, and in typical pool-based allocations the byte falls within allocation slack. This issue has been patched via commit d6a0e7f.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57160.json, https://github.com/pjsip/pjproject/security/advisories/GHSA-277r-3q2j-mxcw, https://nvd.nist.gov/vuln/detail/CVE-2026-57160, https://github.com/pjsip/pjproject/commit/d6a0e7f76611c3a6f530ee051e3e7a622bb1748c

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d6a0e7f76611c3a6f530ee051e3e7a622bb1748c

    Affected versions

    2.17

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-57160 | CVE-DB