CVE-2026-57161

Name of the Vulnerable Software and Affected Versions PJSIP versions prior to commit acc03b5

Description A stack buffer overflow exists in PJSUA when processing Service-Route headers in a registration response within the update service route() function in pjsua acc.c. This issue affects applications using the PJSUA/PJSUA2 account API. When a registrar returns an excessive number of Service-Route URIs in a 2xx response to a REGISTER request, they are stored in a fixed-size array without boundary checks, allowing data to be written past the end of the array on the stack. This can lead to memory corruption or unexpected application termination, resulting in a denial of service. The malicious response could originate from a compromised registrar or a spoofed response over unprotected transports.

Recommendations Update to the version containing commit acc03b5.