CVE-2026-25994 is a critical buffer overflow (CVSS 9.8) in PJSIP, the open source multimedia communication library. The PJNATH ICE session mishandles credentials with excessively long usernames. Upgrade to PJSIP 2.17 and check software that bundles pjproject. The record does not list it in CISA's KEV catalog, and the advisory we read does not report exploitation.
What's affected
- PJSIP 2.16 and earlier
- Fixed in 2.17 (commit 063b3a1 on the master branch)
The advisory lists no workaround. PJSIP is a C library, so it often arrives inside other products. Applications, softphones and telephony servers may carry their own copy under a different version scheme.
How to check if you're exposed
Start with what you build yourself. In a project that vendors pjproject, the version is defined in the library's headers, and a tool built from it can usually report it:
pjsua --version
For packaged software, ask the vendor or your distribution whether the bundled pjproject includes the fix for this CVE. A package version number alone will not tell you, because fixes are often backported.
Also list containers and appliances that do SIP or WebRTC style calling, since those are the products most likely to embed it.
What to do now
- Upgrade pjproject to 2.17 or later wherever you build it.
- Ask each vendor of software that embeds PJSIP for a build with the fix, and record the answer.
- Rebuild and redeploy images that compile pjproject from source.
- Where a service accepts ICE negotiation from the internet, review its exposure and limit it to the networks that need it.
- Add the library to your inventory with its version, so the next advisory is a lookup.
Why it matters
CWE-120 is the classic buffer overflow: data is copied into a fixed-size buffer without checking that it fits. Here the data is the username in ICE credentials. ICE sets up peer to peer media paths, so its parsers handle text that arrives from the network before a call is trusted.
The score of 9.8 reflects network reach with no privileges and full impact. The advisory is short and does not describe exploitation, so we do not claim code execution either. What it does establish is the class: memory corruption in a network facing parser, which is why it gets a patch priority.
Libraries like this one are where inventory pays off. You rarely install pjproject directly, so the fastest way to learn whether you are affected is a record of what your products contain.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
How do I know if a product I run bundles PJSIP?
Check the vendor's notes or the software bill of materials, if they publish one. Failing that, ask the vendor directly.
Sources
Last reviewed: 19 October 2026.
