CVE-2026-57159 is a high severity out-of-bounds read and write in PJSIP, the open source multimedia library from Teluu. A crafted remote SDP can corrupt memory when the remote payload-type map option is enabled. Default builds are not affected. The fix is pjproject commit 673b978.
What's affected
- Product: Teluu PJSIP (pjproject), the SDP negotiator in
pjmedia/src/pjmedia/sdp_neg.c. - Affected: builds from before commit 673b978 that enable
PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP. - Not affected: default builds, because the option is off by default.
- Fixed: commit 673b978. The record does not name a release number, so check the pjproject advisory and release notes for the first release that contains it.
How to check if you're exposed
The first question is whether you build with the option enabled. Search your build configuration and any config_site.h file.
grep -rn "PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP" .
If the macro is undefined or set to 0, the vulnerable path is not reached. If it is set to 1, or if a vendor product that embeds PJSIP sets it for you, treat the build as exposed. Applications that embed PJSIP through a wrapper, a mobile SDK or a softphone library should ask the vendor which pjproject revision they ship.
If you are unsure what your product bundles, look for a vendored pjproject directory or a shared library, and compare its revision with the fix commit.
What to do now
- Find every product in your estate that embeds PJSIP, including vendored copies and wrappers.
- Check whether
PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAPis enabled in each build. - Update to a pjproject release or revision that contains commit 673b978, or backport the commit if you maintain your own fork.
- If you cannot update at once, turn the option off. It is an interoperability option, and the advisory says it is disabled by default.
- Add a malformed SDP case to your SIP test suite so a regression in payload type handling is caught early.
Why it matters
The weaknesses are CWE-129 (Improper Validation of Array Index) and CWE-787 (Out-of-bounds Write). The function assign_pt_and_update_map() uses payload type numbers from a remote SDP offer or answer to index fixed size tables. The commit message explains that the tables cover payload types 96 to 127, but numbers were only checked against the lower bound. A remote attribute with a very large payload number therefore indexed outside the table.
The record says the practical impact is memory corruption and denial of service, and that code execution is not demonstrated. It scores 7.5 (High), with no privileges or user interaction needed. That is worth taking seriously for any SIP endpoint exposed to the internet, but the non-default requirement narrows the real world exposure a lot. The record does not mark it as exploited in the wild.
Quick check
Are default PJSIP builds vulnerable?
No. The record says the path is only reached when PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP is enabled, and that the default is disabled.
Sources
Last reviewed: 18 October 2026.
