CVE-2026-41415
criticalPJSIP is a free and open source multimedia communication library written in C.
Vendor / product: Teluu — pjsip
PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an out-of-bounds read when parsing a malformed Content-ID URI in SIP multipart message body. Insufficient length validation can cause reads beyond the intended buffer bounds. This vulnerability is fixed in 2.17.
CVSS
9.1
9.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-04-24 19:17
Modified: 2026-10-26 21:10
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
teluu / pjsip <2.17
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/pjsip/pjproject/commit/4225a93c16661538005017883fbc8f1ea1d5f4b0
Patch / mitigation: https://github.com/pjsip/pjproject/security/advisories/GHSA-935m-fmf5-j4pm
References
- https://github.com/pjsip/pjproject/commit/4225a93c16661538005017883fbc8f1ea1d5f4b0 security-advisories@github.com
- https://github.com/pjsip/pjproject/security/advisories/GHSA-935m-fmf5-j4pm security-advisories@github.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗