PT-2026-7717 · Pjsip+1 · Pjsip+1

Gherasimgeorgemarian82 · Published 2026-02-11 · Updated 2026-03-24 · CVE-2026-25994

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PJSIP versions prior to 2.17

Description PJSIP is a multimedia communication library implemented in C. A buffer overflow condition exists in the PJNATH ICE Session component when handling credentials containing overly long usernames. This can potentially lead to remote code execution without authentication.

Recommendations Upgrade to version 2.17 or later.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2026-25994

GHSA-J29P-PVH2-PVQP

USN-8122-1

Affected Products

Pjsip

Ubuntu

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25994.json · Exploit
• https://github.com/pjsip/pjproject/security/advisories/GHSA-j29p-pvh2-pvqp · Vendor Advisory
• https://github.com/pjsip/pjproject/commit/063b3a155f163cc5a9a1df2c56b6720fd3a0dbb0 · Patch
• https://ubuntu.com/security/CVE-2021-21375 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16872 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43299 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000099 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15260 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43303 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37706 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43300 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25994 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43301 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8122-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16875 · Vendor Advisory