CVE-2026-40892 is a stack buffer overflow in PJSIP, the multimedia communication library, listed by NVD at CVSS 9.8. The maintainers rate it low because the vulnerable input is set by the application. Version 2.17 fixes it. Update, and validate credential length.
What's affected
- Affected: PJSIP 2.16 and lower
- Fixed: 2.17
The affected function is pjsip_auth_create_digest2, when applications use pre computed digest credentials (the PJSIP_CRED_DATA_DIGEST type). It copies credential data using the supplied length without an upper bound check, into a 128 byte stack buffer.
The GitHub advisory rates this as low severity and says it is not remotely exploitable through standard SIP handling, because the credential structure is always provided by the application. NVD scores it 9.8. The gap is worth understanding: the vector assumes the data reaches the function, and the advisory says that depends on your code.
How to check if you're exposed
Find which PJSIP your product bundles. For a source build:
grep -rn "PJ_VERSION" pjlib/include/pj/config.h
For a distribution package, query the package manager for pjproject or libpjproject. Then search your own code for the digest credential type and see where its data comes from:
grep -rn "PJSIP_CRED_DATA_DIGEST" .
If the data comes from fixed configuration you control, the exposure is low. If any of it is influenced by outside input, treat it as exposed.
What to do now
- Update PJSIP to 2.17 or later, including products that bundle it, such as softphones and gateways.
- As the advisory suggests, check that the digest credential data length does not exceed the expected hex string length before calling the API.
- Rebuild and re-test applications that link PJSIP statically.
- Ask vendors of products that embed PJSIP whether they have shipped 2.17.
Why it matters
The weakness is CWE-121, stack based buffer overflow. A length value controls a copy into a fixed size local buffer with no cap. Stack overflows can overwrite return addresses, which is why the NVD vector scores impact high.
The disagreement between a 9.8 and a low rating is a good reminder to read the advisory and not only the number. Reachability decides risk here: the question is whether untrusted data can ever arrive in that field in your application. The record does not report exploitation in the wild.
Quick check
Why does NVD say 9.8 while the maintainers say low?
NVD scored the flaw in the function. The maintainers rated real exposure, because the vulnerable data is supplied by the application and not the SIP network.
Sources
Last reviewed: 19 October 2026.
