PT-2026-26551 · Pjsip · Pjsip

Dhkts1 · CVE-2026-32942 · Published 2026-03-20 · Updated 2026-03-24

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PJSIP versions 2.16 and below

Description PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below contain a heap use-after-free issue in the ICE session. This occurs when race conditions happen between session destruction and callbacks.

Recommendations Update to version 2.17 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-32942

GHSA-G88Q-C2HM-Q7P7

Affected Products

Pjsip

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32942.json · Exploit
• https://github.com/pjsip/pjproject/security/advisories/GHSA-g88q-c2hm-q7p7 · Vendor Advisory
• https://github.com/pjsip/pjproject/commit/c9caceddabda7f18337b2a82d25d65f6224b450a · Patch
• https://cve.org/CVERecord?id=CVE-2026-32942 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32942 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2026-32942 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32942 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32942 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32942 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32942 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32942 · Vendor Advisory
• https://github.com/pjsip/pjproject/issues/1451 · Note
• https://twitter.com/VulmonFeeds/status/2034864603490898423 · Twitter Post
• https://security.alpinelinux.org/vuln/CVE-2026-32942 · Note
• https://twitter.com/cyberbivash/status/2034862594473726090 · Twitter Post