A high-severity memory corruption vulnerability in the PJSIP library, specifically affecting configurations with the remote payload-type map maintenance feature enabled, poses a risk of service disruption.

This flaw involves improper validation of array indices in the assign_pt_and_update_map function, leading to out-of-bounds memory access when processing crafted SDP offers. The vulnerability is exploitable by unauthenticated remote attackers, provided the optional PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP feature is active.

Successful exploitation can lead to significant memory corruption and denial of service, potentially resulting in the crash of voice or multimedia communication services relying on the PJSIP library. With a CVSS score of 8.4, this vulnerability is categorized as high severity because it enables remote disruption of critical infrastructure without requiring authentication, which could lead to substantial operational downtime.

Immediate Action: Update the PJSIP library to commit 673b978 or later, or verify if the PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP feature is enabled and disable it if not strictly required for interoperability.

Proactive Monitoring: Monitor application logs and system crash reports for unexpected termination of the multimedia stack or signs of anomalous memory access errors.

Compensating Controls: Implement strict boundary validation for SDP packets at the network edge or via a Session Border Controller to filter malformed payloads before they reach the internal PJSIP implementation.

Public Exploit Available: Unknown

Organizations utilizing PJSIP must audit their build configurations to determine if the vulnerable feature is active. Given the potential for remote denial of service, applying the vendor-provided patch is the recommended course of action to ensure long-term stability and security against memory corruption attacks.