CVE-2026-57166

Name of the Vulnerable Software and Affected Versions PJSIP versions prior to commit 4472a31

Description A stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when rendering feedback for an entered command line. This occurs because several command-line handling paths write an attacker-influenced amount of data into fixed-size buffers without sufficient bounds checking. A malformed or overly long command line can overflow these buffers, potentially leading to application termination. This issue specifically affects applications that enable the telnet CLI front-end via the pj cli telnet create() function or the --cli-telnet-port parameter. Since the telnet CLI is an unauthenticated interactive administration interface, any client with network access to it can trigger this condition.

Recommendations Update to the version containing commit 4472a31. As a temporary mitigation, disable the telnet CLI front-end by avoiding the use of the pj cli telnet create() function or the --cli-telnet-port parameter.