Rpaleari-Spike

An authenticated attacker can cause a crash by sending a specially crafted `SIP NOTIFY` request. This occurs due to a buffer over-read in the `PJSIP MWI body parser`. To exploit this, the attacker must successfully authenticate via a username and password or through `source IP address matching`.

An unbounded `sscanf` function in `res pjsip pubsub` occurs when parsing the `Message-Account` field of an `MWI NOTIFY` message. This allows an unauthenticated attacker to send a specially crafted packet that triggers a stack buffer overflow, corrupting the underlying transport and permanently disabling all SIP functionality. A system restart is necessary to restore operations.