CVE-2026-57163

PJSIP, an open-source C multimedia/SIP communication library, contains a stack buffer overflow in tls_cert_get_info() of its GnuTLS TLS backend (ssl_sock_gtls.c), where an incorrect buffer-size value lets an oversized Subject Alternative Name entry from a peer certificate be written past the end of a fixed-size stack buffer. A network-positioned attacker triggers it during the TLS handshake — a malicious server against a connecting client, or a malicious client against a server that requests certificates — by presenting a crafted certificate, before any SIP-level authentication takes place. A successful attack can cause unexpected application termination (denial of service) or memory corruption with potential control-flow hijack, reflected in the high CVSS 4.0 score of 8.8. Only PJSIP builds configured with the GnuTLS backend (--with-gnutls) are affected; builds using OpenSSL or Apple SecureTransport/Network.framework are not. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: If your PJSIP build uses --with-gnutls, update to the next release incorporating commit c4a151a or rebuild from source including that commit. Builds using the OpenSSL or Apple SecureTransport/Network.framework backends require no action. As an interim mitigation, prefer OpenSSL-backend builds or restrict TLS peers to trusted endpoints, and check vendors of embedded/telephony products that bundle PJSIP (common in Debian-family packages) for patched advisories.