PT-2026-26586 · Pjsip · Pjsip

Sauwming · Publicado 2026-03-20 · Atualizado 2026-03-22 · CVE-2026-33069

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PJSIP versions 2.16 and below

Description PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below contain a cascading out-of-bounds heap read in the pjsip multipart parse() function. After boundary string matching, the curptr variable is advanced past the delimiter without verifying it has not reached the buffer end, allowing 1-2 bytes of adjacent heap memory to be read. All applications that process incoming SIP messages with multipart bodies or SDP content are potentially affected.

Recommendations Upgrade to version 2.17.

Exploit

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2026-33069

GHSA-X5PQ-QRP4-FMRJ

Produtos afetados

Pjsip

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33069.json · Exploit
• https://github.com/pjsip/pjproject/commit/f0fa32a226df5f87a9903093e5d145ebb69734db · Correção
• https://github.com/pjsip/pjproject/security/advisories/GHSA-x5pq-qrp4-fmrj · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33069 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2035627011033518095 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33069 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33069 · Nota de Segurança
• https://osv.dev/vulnerability/ALPINE-CVE-2026-33069 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2035023315421581340 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2026-33069 · Aviso do Fabricante
• https://security.alpinelinux.org/vuln/CVE-2026-33069 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33069 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-33069 · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2034914400180519150 · Publicação no Twitter
• https://twitter.com/VolerionSec/status/2034925101385183648 · Publicação no Twitter