{"id":"CVE-2026-57159","summary":"PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance","details":"PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c uses payload-type numbers taken from a remote SDP offer or answer to index fixed-size internal tables without sufficient bounds validation, so a crafted remote SDP can cause memory access outside those tables. The practical impact is memory corruption and denial of service; code execution is not demonstrated. This path is only reached when PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP is enabled. The default is disabled, so default builds are not affected; the feature is an interoperability option that integrating products may enable. This issue has been patched via commit 673b978.","aliases":["GHSA-rfwg-w9gq-9mw2"],"modified":"2026-09-06T08:14:56.769210Z","published":"2026-09-04T17:11:26.957Z","database_specific":{"cwe_ids":["CWE-129","CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57159.json","unresolved_ranges":[{"extracted_events":[{"fixed":"673b978aab1fe3ab874247be32c871acc880cbeb"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57159.json"},{"type":"ADVISORY","url":"https://github.com/pjsip/pjproject/security/advisories/GHSA-rfwg-w9gq-9mw2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57159"},{"type":"FIX","url":"https://github.com/pjsip/pjproject/commit/673b978aab1fe3ab874247be32c871acc880cbeb"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pjsip/pjproject","events":[{"introduced":"0"},{"fixed":"673b978aab1fe3ab874247be32c871acc880cbeb"}],"database_specific":{"source":"REFERENCES"}}],"versions":["2.17","2.16","2.15","2.14","2.13","2.12","2.11","2.10"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57159.json","vanir_signatures_modified":"2026-09-06T08:14:56Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/pjsip/pjproject/commit/673b978aab1fe3ab874247be32c871acc880cbeb","target":{"file":"pjmedia/src/pjmedia/sdp_neg.c"},"deprecated":false,"digest":{"line_hashes":["84075036491404454795379857975113645869","91351891441371466037291820755218213626","259616497289641491307512189959401632361","300664019952683306011171734226530107437","262899666250394304362950682000558433682","40715923653879046834205350734152380727","38147398253958268077128016025138833189","132070823939670038851053106086554673624","84928040196270781578388147304621856962","135122855840337833958877683579515567961","183551940226846840928637258898076377184","53308175487299016464155205375880266620","273714615420388885268254014284976913007","262879762003449681301190849850592647599","62356376928754685806667233269232161613","297476674359960888753876397387450168684","133869348074267560695319091426084496674","111243120082963503485897520028196546339","271475458843168175536245550014338803601"],"threshold":0.9},"id":"CVE-2026-57159-31d215e6","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"254332338065547120691665388224002596358","length":5096},"id":"CVE-2026-57159-fe1c8916","signature_type":"Function","signature_version":"v1","source":"https://github.com/pjsip/pjproject/commit/673b978aab1fe3ab874247be32c871acc880cbeb","target":{"file":"pjmedia/src/pjmedia/sdp_neg.c","function":"assign_pt_and_update_map"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N"}]}