A high-severity stack buffer overflow in PJSIP, specifically within the GnuTLS TLS backend, poses a significant risk of remote code execution or application crashes for affected implementations.

The vulnerability is a stack-based buffer overflow (CWE-121) occurring in the tls_cert_get_info function, which is triggered when parsing Subject Alternative Name extensions in certificates. The flaw is reachable by an unauthenticated network-positioned attacker during the initial TLS handshake process.

The potential for memory corruption or control flow hijacking represents a severe threat to system integrity and availability. An attacker could crash communication services, leading to denial of service, or potentially execute arbitrary code on the host, which justifies the CVSS score of 8.8. Organizations relying on PJSIP for critical telephony or messaging infrastructure are at elevated risk due to the exploitability occurring before any authentication layer.

Immediate Action: Update the PJSIP library to a version containing commit c4a151af86fadd16d9480b2603eeb2abf4fb4f78 or later. If updating is not immediately feasible, verify if the build can be switched to use OpenSSL or Apple SecureTransport instead of GnuTLS.

Proactive Monitoring: Monitor system logs for repeated TLS handshake failures or unexpected service crashes, which may indicate an attacker attempting to fuzz the certificate parsing logic.

Compensating Controls: Deploy network-level inspection to identify and block traffic containing malformed or suspicious TLS certificates, though this may be limited by encrypted transport.

Public Exploit Available: No

Given the reachability of this vulnerability during the initial handshake, it represents a critical security gap for any service utilizing PJSIP with the GnuTLS backend. Administrators should prioritize patching or reconfiguring their build environment to avoid the vulnerable library components immediately to prevent potential remote exploitation.