A critical stack-based buffer overflow in the PJSIP multimedia library allows unauthenticated remote attackers to trigger memory corruption or potentially hijack control flow.

This is a stack-based buffer overflow (CWE-121) occurring in the SRTP/SDES media transport layer. An unauthenticated remote attacker can trigger this vulnerability by sending a maliciously crafted SIP INVITE message containing an excessive number of a=crypto attributes during the media negotiation phase.

The vulnerability carries a CVSS score of 8.8, indicating a high severity risk. Successful exploitation can lead to application crashes, resulting in denial of service, or potentially allow an attacker to gain execution control over the affected system. Given that this is reachable before application-level authentication, the risk to public-facing communication infrastructure is substantial and warrants immediate attention.

Immediate Action: Update the PJSIP pjproject library to commit a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9 or later.

Proactive Monitoring: Monitor SIP signaling logs for unusually large INVITE packets or anomalous sequences of a=crypto attributes that may indicate attempts to trigger the overflow.

Compensating Controls: If immediate patching is not feasible, consider disabling SRTP or configuring network-level firewalls to inspect and drop SIP INVITE packets that exceed expected attribute lengths.

Public Exploit Available: No (exploit_available: false)

The potential for memory corruption and control flow hijacking in a widely used communication library makes this a high-priority security concern. Administrators must prioritize updating the pjproject library to the patched commit immediately to eliminate the risk of remote exploitation. Consistent with secure development practices, ensure that all dependencies are regularly audited for similar vulnerabilities.