PT-2026-26552 · Pjsip · Pjsip

Sauwming · Published 2026-03-20 · Updated 2026-03-24 · CVE-2026-32945

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PJSIP versions 2.16 and below

Description PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below contain a Heap-based Buffer Overflow in the DNS parser's name length handler. This impacts applications using PJSIP’s built-in DNS resolver, such as those configured with pjsua config.nameserver or UaConfig.nameserver in PJSUA/PJSUA2. Users who rely on the operating system resolver (e.g., getaddrinfo()) by not configuring a nameserver, or those using an external resolver via pjsip resolver set ext resolver(), are not affected.

Recommendations Versions 2.16 and below: Upgrade to version 2.17 or disable DNS resolution in the PJSIP configuration by setting nameserver count to zero, or use an external resolver implementation.

Exploit

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

CVE-2026-32945

GHSA-JR2P-P2W4-RR9Q

Affected Products

Pjsip

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32945.json · Exploit
• https://github.com/pjsip/pjproject/security/advisories/GHSA-jr2p-p2w4-rr9q · Vendor Advisory
• https://github.com/pjsip/pjproject/commit/5311aee398ae9d623829a6bad7b679a193c9e199 · Patch
• https://ubuntu.com/security/CVE-2026-32945 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32945 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32945 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32945 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32945 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-32945 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32945 · Security Note
• https://twitter.com/cyberbivash/status/2034862591705592318 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034862043778404773 · Twitter Post
• https://twitter.com/dailycve/status/2036281695196914096 · Twitter Post
• https://twitter.com/VolerionSec/status/2034847470681796726 · Twitter Post
• https://twitter.com/CVEnew/status/2034891567681478711 · Twitter Post