PT-2026-23655 · Pjsip · Pjsip

Mfroeschl · Published 2026-03-06 · Updated 2026-03-11 · CVE-2026-29068

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions PJSIP versions prior to 2.17

Description PJSIP is a multimedia communication library written in C. A stack buffer overflow exists in the Opus codec parser when processing RTP payloads containing more frames than the allocated buffer can handle. This issue could allow attackers to crash applications or potentially execute code. No authentication is required to exploit this issue.

Recommendations Upgrade to version 2.17 or later.

Exploit

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-29068

GHSA-PQWW-JRXR-457F

Affected Products

Pjsip

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29068.json · Exploit
• https://github.com/pjsip/pjproject/commit/6c9024511bf5307ff72efde1f90c9a2a226d8967 · Patch
• https://github.com/pjsip/pjproject/security/advisories/GHSA-pqww-jrxr-457f · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-29068 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29068 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-29068 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-29068 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-29068 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-29068 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-29068 · Vendor Advisory
• https://twitter.com/cracbot/status/2031686868740571354 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2029912296454021508 · Twitter Post
• https://twitter.com/cyberbivash/status/2029837072308043944 · Twitter Post
• https://twitter.com/CVEnew/status/2029975562459173178 · Twitter Post
• https://twitter.com/VolerionSec/status/2029819644932981226 · Twitter Post