CVE-2026-57161 is a high severity stack buffer overflow in PJSIP's PJSUA library. A registration response with too many Service-Route headers can write past a fixed array. The likely result is a crash, though memory corruption cannot be excluded. The fix is pjproject commit acc03b5.
What's affected
- Product: Teluu PJSIP (pjproject), function
update_service_route()inpjsip/src/pjsua-lib/pjsua_acc.c. - Affected: builds from before commit acc03b5 that register accounts through the PJSUA or PJSUA2 account API, which is the default registration path.
- Fixed: commit acc03b5. The record names no release number, so check the pjproject advisory for the first release that includes it.
- Trigger: a 2xx response to REGISTER from a compromised or malicious registrar, or a spoofed response over an unprotected transport.
How to check if you're exposed
Work out whether any of your applications use PJSUA or PJSUA2 to register against a SIP registrar. Softphones, SIP clients, IoT devices with voice features and mobile calling apps are the usual candidates. Then find the pjproject revision they bundle.
grep -rn "PJSUA_ACC_MAX_PROXIES" .
That macro sizes the array involved, so it tells you the code is present, not that it is vulnerable. The deciding fact is whether the source contains the bounds check that commit acc03b5 added before each write to the array.
Also review your transport. The advisory says a spoofed response is possible over unprotected transports, so UDP registration without TLS widens the exposure.
What to do now
- List the applications and devices that embed PJSIP and register through PJSUA.
- Update to a pjproject revision that includes commit acc03b5, or apply the commit to your fork.
- Prefer TLS for SIP registration so a network attacker cannot inject a response.
- Restrict which registrars your clients will trust, and monitor for unexpected application restarts on devices that register.
- Ask vendors of closed source products that embed PJSIP for their patched build.
Why it matters
The weakness is CWE-121 (Stack-based Buffer Overflow). The commit message says the count of Service-Route URIs was checked only as a loop continuation condition, which does not catch accumulation across several single URI headers. A response with more headers than the array holds writes past its end.
The record notes that the values written are internal pointers rather than arbitrary data, so a crash is the most likely outcome. It scores 8.2 (High). The attacker has to control or spoof the registrar response, which limits who can reach it, but a hostile registrar is a realistic case for any client that registers to third party servers. The record does not mark it as exploited in the wild.
Quick check
Who can trigger this?
A registrar returning an oversized set of Service-Route headers in a 2xx REGISTER response, either one that is malicious or compromised, or an attacker who spoofs the response on an unprotected transport.
Sources
Last reviewed: 18 October 2026.
