CVE-2026-41415: PJSIP: SIP Multipart CID URI Length Underflow

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-24 · updated 2026-10-26
Weakness: CWE-125

Description

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an out-of-bounds read when parsing a malformed Content-ID URI in SIP multipart message body. Insufficient length validation can cause reads beyond the intended buffer bounds. This vulnerability is fixed in 2.17.

Affected products

teluu pjsip: before 2.17 — fixed in 2.17

How to fix

Upgrade to a fixed version: teluu pjsip 2.17. Check the vendor advisory for mitigations.

References

https://github.com/pjsip/pjproject/commit/4225a93c16661538005017883fbc8f1ea1d5f4b0
https://github.com/pjsip/pjproject/security/advisories/GHSA-935m-fmf5-j4pm

Get alerted when CVE-2026-41415 or the next vulnerability affects your stack