An unbounded `sscanf` function in `res pjsip pubsub` occurs when parsing the `Message-Account` field of an `MWI NOTIFY` message. This allows an unauthenticated attacker to send a specially crafted packet that triggers a stack buffer overflow, corrupting the underlying transport and permanently disabling all SIP functionality. A system restart is necessary to restore operations.