CVE-2026-57162 is a critical (CVSS 9.1) stack buffer overflow in PJSIP's SRTP and SDES media transport, version 2.17 and lower. A remote peer can trigger it from a SIP INVITE before login. The fix is commit a1b707c, and the advisory lists no workaround.
What's affected
The PJSIP advisory (GHSA-m9g3-jcj8-qjfm) lists versions 2.17 or lower as affected, and at the time it was written, no patched release. The patch is commit a1b707c in the master branch. Check the pjproject releases page for a release that includes it before you rely on a version number.
Only applications with SRTP enabled using SDES keying are affected, that is, use_srtp set to optional or mandatory. Applications that do not enable SRTP are not affected.
The flaw sits in sdes_encode_sdp in transport_srtp_sdes.c. Attributes from the remote offer are collected into a fixed size array with no limit on their number.
How to check if you're exposed
PJSIP is often embedded, so find where it sits.
- Look for pjproject or pjsua in your package manager, vendored source trees and container images, and note the version.
- Check whether your application enables SRTP, and whether it uses SDES keying.
- Check softphones, VoIP gateways and appliances from other vendors. Ask them whether they embed PJSIP and what their fix status is.
Run the free in-browser dependency scan at https://gold.safeguard.sh/scan against your manifest or lockfile. It lists vulnerable packages without installing anything.
What to do now
- Rebuild PJSIP with commit a1b707c, or move to a release that includes it once you have confirmed that.
- Where your vendor ships PJSIP inside a product, ask for their patch status in writing.
- If you can, restrict SIP signalling to known peers and trunks, so unknown parties cannot send offers.
- Check the pjproject releases page regularly for a tagged release that includes the commit.
- Watch for crashes of SIP services, which can signal attempts.
Why it matters
The weakness is CWE-121, stack based buffer overflow. A list from the remote side is copied into a fixed array without a bound, so a peer that sends too many entries writes past the end on the stack. The advisory says the impact ranges from a crash to control flow hijack.
The key fact is timing. This is reachable during offer and answer, before application level authentication, so the usual login defences do not apply. VoIP stacks parse text from strangers by design. Bound every list that the remote side controls. The record is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Is there a workaround?
The advisory says there is no known workaround. Apply the patch commit, and limit who can send SIP offers to your service.
Sources
Last reviewed: 19 October 2026.
