PT-2026-26551 · Pjsip · Pjproject

Published 2026-03-20 · Updated 2026-03-20 · CVE-2026-32942

NVD

CVSS v4.0

8.0

High

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below contain a heap use-after-free vulnerability in the ICE session that occurs when there are race conditions between session destruction and the callbacks. This issue has been fixed in version 2.17.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-32942

Affected Products

Pjproject

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-32942 · Security Note
• https://github.com/pjsip/pjproject/security/advisories/GHSA-g88q-c2hm-q7p7 · Note
• https://github.com/pjsip/pjproject/commit/c9caceddabda7f18337b2a82d25d65f6224b450a · Note
• https://github.com/pjsip/pjproject/issues/1451 · Note