CVE-2026-57161

PJSIP, a widely used open-source multimedia (SIP) communication library written in C, contains a stack buffer overflow (CWE-121) in update_service_route() in pjsua_acc.c, where Service-Route URIs from a 2xx response to REGISTER are stored into a fixed-size stack array without bounding the number of headers. An attacker who controls or compromises the registrar — or, on unprotected transports, any on-path attacker who spoofs a registration response — can supply an excessive number of Service-Route headers and write past the end of the array. Because the overwritten values are internal pointers rather than attacker-controlled data, the most likely outcome is unexpected application termination (denial of service), though memory corruption cannot be excluded; the flaw is rated 8.8 (High) under CVSS 4.0. Any application that registers using the PJSUA/PJSUA2 account API — described as the default registration path — is affected, including softphones, VoIP SDKs, and embedded clients built on this library. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS estimates the 30-day exploitation probability at about 0.3%.

What to do: Rebuild applications that use the PJSUA/PJSUA2 registration path against PJSIP source at or including commit acc03b5, and confirm the commit is present in your build since no fixed release version is documented; watch the upstream project for an official release incorporating the fix. Prefer TLS-protected SIP transports so registration responses cannot be spoofed on-path, and ensure clients only accept responses from their configured registrar. Operators of softphone fleets or products embedding PJSIP should contact their vendor for patched builds and verify their product uses the affected PJSUA/PJSUA2 path.