PT-2026-35059 · Pjsip · Pjsip

Dhkts1 · CVE-2026-41416 · Published 2026-04-24 · Updated 2026-04-28

Positive Technologies (AI Summary)

CVSS v4.0

8.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions PJSIP versions prior to 2.17

Description An integer overflow occurs in the media stream buffer size calculation when processing Session Description Protocol (SDP) with asymmetric ptime configuration. This overflow can lead to an undersized buffer allocation, potentially resulting in memory corruption or unexpected application termination.

Recommendations Update to version 2.17.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2026-41416

GHSA-F33G-8HJQ-62XR

Affected Products

Pjsip

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41416.json · Exploit
• https://github.com/pjsip/pjproject/commit/66fe416c96e957417621b7be16e9e587d159f9bb · Patch
• https://github.com/pjsip/pjproject/security/advisories/GHSA-f33g-8hjq-62xr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-41416 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41416 · Security Note
• https://ubuntu.com/security/CVE-2026-41416 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41416 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41416 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41416 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41416 · Vendor Advisory
• https://twitter.com/CVEnew/status/2047798575296651321 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2047890052391260581 · Twitter Post