CVE-2026-41415 is a critical out-of-bounds read (CVSS 9.1) in PJSIP, the C multimedia communication library. In version 2.16 and earlier, a malformed Content-ID URI in a SIP multipart message body can cause reads past a buffer. The fix is version 2.17.
What's affected
Per the record, PJSIP 2.16 and earlier are affected and 2.17 contains the fix. The GitHub advisory is titled SIP Multipart CID URI Length Underflow, which points to a length check problem.
PJSIP is a library, so it often hides inside other software: softphones, VoIP servers, embedded devices and applications that bundle a copy.
How to check if you're exposed
Find direct and bundled copies. If you build against a system package:
pkg-config --modversion libpjproject
For software that vendors its own PJSIP, check the source tree or the vendor's release notes for the bundled version. Search images and repositories for pjproject or pjsip. A free dependency scan can surface copies in your manifests, though a vendored C library needs a source check as well.
Then ask whether the affected service parses SIP from untrusted networks. A public SIP endpoint is the highest priority.
What to do now
- Upgrade PJSIP to 2.17 or later, or install your vendor's updated package.
- For bundled copies, check for a patched release of the host product and apply it.
- Limit SIP signalling to known peers with firewall rules where you can.
- Watch for crashes of SIP services, since an out-of-bounds read can crash a process.
Why it matters
The record lists CWE-125, out-of-bounds read. Insufficient length validation lets the parser read beyond the intended buffer. The vector shows high confidentiality and availability impact: memory contents might leak, or the service might crash.
Memory safety bugs in network parsers are a steady source of critical CVEs. The record does not flag this one as known exploited.
Quick check
We use a product that bundles PJSIP. What do we do?
Ask the vendor which PJSIP version is inside and when a fix ships. Restrict who can send SIP traffic to it in the meantime.
Sources
Last reviewed: 19 October 2026.
