What’s Vulnerable › Vulnerabilities

CVE-2022-39244: Buffer overflow in pjlib scanner and pjmedia

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-06 · updated 2026-06-17
• Weakness: CWE-120

Description

PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This issue has been patched and is available as commit c4d3498 in the master branch and will be included in releases 2.13 and later. Users are advised to upgrade. There are no known workarounds for this issue.

Affected products

• Pjsip: before 2.13 — fixed in 2.13

How to fix

Upgrade to a fixed version: Pjsip 2.13. Check the vendor advisory for mitigations.

References

• https://github.com/pjsip/pjproject/commit/c4d34984ec92b3d5252a7d5cddd85a1d3a8001ae
• https://github.com/pjsip/pjproject/security/advisories/GHSA-fq45-m3f7-3mhj
• https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html
• https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
• https://security.gentoo.org/glsa/202210-37
• https://www.debian.org/security/2023/dsa-5358
• https://github.com/pjsip/pjproject/commit/c4d34984ec92b3d5252a7d5cddd85a1d3a8001ae
• https://github.com/pjsip/pjproject/security/advisories/GHSA-fq45-m3f7-3mhj
• https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html
• https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
• https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
• https://security.gentoo.org/glsa/202210-37

Get alerted when CVE-2022-39244 or the next vulnerability affects your stack