A critical heap buffer overflow vulnerability in the PJSIP PJLIB-UTIL library allows unauthenticated remote attackers to trigger memory corruption or denial of service.

This is a heap-based buffer overflow (CWE-122) occurring in the HTTP client component when handling large response bodies. Unauthenticated attackers can exploit this by providing a maliciously crafted HTTP response to applications that buffer the entire response body at once.

Successful exploitation poses a significant risk to the availability and integrity of systems utilizing the PJProject library. An attacker could potentially achieve remote code execution or cause an application crash, leading to service disruption. Given the CVSS score of 8.3, this flaw is categorized as high severity and requires immediate attention to prevent potential system compromise.

Immediate Action: Update the PJSIP library to the commit version 8d5956afab2ede95ddb199078dc19a8ac0114f3d or higher to resolve the buffer size calculation error.

Proactive Monitoring: Monitor application logs for unexpected crashes or errors originating from the HTTP client module. Ensure network traffic is inspected for anomalous HTTP response headers or unusually large content lengths.

Compensating Controls: If an immediate update is not feasible, restrict application connectivity to trusted HTTP servers only. Implement strict input validation or use a Web Application Firewall to filter malicious HTTP traffic.

Public Exploit Available: No

Organizations utilizing PJSIP must prioritize updating their libraries to the patched version. The vulnerability allows for memory corruption, which is a common precursor to remote code execution. Please audit your applications to determine if they utilize the PJLIB-UTIL HTTP client in a way that buffers entire responses, and apply the vendor-provided patch as the primary mitigation strategy.