CVE-2026-57159

CVE-2026-57159 is a remote out-of-bounds read and write in the SDP negotiator of pjmedia, the media-stack component of the open-source PJSIP multimedia communication library written in C. The flaw is in assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c, which uses payload-type numbers taken from a remote SDP offer or answer to index fixed-size internal tables without sufficient bounds validation, so a crafted remote SDP message can cause memory access outside those tables. An attacker who can deliver crafted SDP to a vulnerable endpoint gains memory corruption that can crash the process and cause denial of service; code execution is possible in principle but not demonstrated. Only deployments that explicitly enable the non-default PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP interoperability option are affected, so default builds are not exposed. No public proof-of-concept, no CISA KEV listing, and no known exploitation; EPSS is low at 0.3% probability of exploitation in 30 days.

What to do: If you build or deploy PJSIP with PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP enabled, update to a revision that includes patch commit 673b978 (the advisory data specifies the commit, not a release number). As an interim mitigation, disable the maintain-remote-PT-map option or restrict SDP ingestion to trusted peers; default builds with the flag disabled need no action. Integrators shipping PJSIP-based softphones, SDKs, and telephony devices should check their build configuration for the flag before triaging.