CVE-2026-57162

PJSIP, a widely embedded open-source C multimedia/SIP library, contains a stack buffer overflow (CWE-121) in its SRTP/SDES media transport, where a=crypto attributes from the remote SDP are collected into a fixed-size stack array without bounding their number during SDP offer/answer processing (sdes_encode_sdp() in transport_srtp_sdes.c). A remote attacker can trigger the flaw simply by sending a SIP INVITE whose SDP media description contains an excessive number of a=crypto attributes, and the code path is reached before any application-level authentication. Successful exploitation can cause application termination (denial of service) and potentially memory corruption or control-flow hijack, which may lead to remote code execution. Only applications and devices that embed PJSIP with SRTP enabled (use_srtp set to optional or mandatory with SDES keying) are affected; deployments that do not enable SRTP are not exposed. There is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at just 0.4%, so no in-the-wild exploitation is known.

What to do: Rebuild or upgrade PJSIP to a version incorporating patch commit a1b707c and update any applications, SDKs, or devices that bundle the library. If patching is delayed, disable SRTP (or SDES keying specifically) or restrict inbound SIP INVITEs to trusted peers with ACLs. Inventory which VoIP clients, servers, and embedded devices in your estate embed PJSIP and confirm whether use_srtp is enabled, since non-SRTP deployments are unaffected.