PT-2026-26586 · Pjsip · Pjsip

Sauwming · Published 2026-03-20 · Updated 2026-03-22 · CVE-2026-33069

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PJSIP versions 2.16 and below

Description PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below contain a cascading out-of-bounds heap read in the pjsip multipart parse() function. After boundary string matching, the curptr variable is advanced past the delimiter without verifying it has not reached the buffer end, allowing 1-2 bytes of adjacent heap memory to be read. All applications that process incoming SIP messages with multipart bodies or SDP content are potentially affected.

Recommendations Upgrade to version 2.17.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-33069

GHSA-X5PQ-QRP4-FMRJ

Affected Products

Pjsip

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33069.json · Exploit
• https://github.com/pjsip/pjproject/commit/f0fa32a226df5f87a9903093e5d145ebb69734db · Patch
• https://github.com/pjsip/pjproject/security/advisories/GHSA-x5pq-qrp4-fmrj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33069 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33069 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33069 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33069 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33069 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33069 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-33069 · Vendor Advisory
• https://twitter.com/CVEnew/status/2035627011033518095 · Twitter Post
• https://twitter.com/cyberbivash/status/2034914400180519150 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2035023315421581340 · Twitter Post
• https://twitter.com/VolerionSec/status/2034925101385183648 · Twitter Post