cve-2026-25994_PJSIP

CVE-2026-25994 – PJNATH ICE Stack Buffer Overflow (pjsip ≤ 2.16)

Overview

CVE-2026-25994 is a stack-based buffer overflow vulnerability affecting the ICE (Interactive Connectivity Establishment) implementation in pjsip ≤ 2.16, specifically within the PJNATH component.

The vulnerability exists in the function:

pj_ice_sess_create_check_list()

located in:

pjnath/src/pjnath/ice_session.c

Vulnerability Details

The issue is caused by unsafe string handling when constructing the ICE username:

char buf[128];                  // Fixed-size stack buffer
username.ptr = buf;
pj_strcpy(&username, rem_ufrag);   // No bounds checking
pj_strcat2(&username, ":");
pj_strcat(&username, &ice->rx_ufrag);

Root Cause

rem_ufrag is taken directly from the SDP attribute:

a=ice-ufrag:

No length validation is performed before copying into a 128-byte stack buffer

This allows an attacker to overflow the stack, potentially overwriting:

Return address

Stack frame

Canary / alignment data

Exploitation

A malicious SIP INVITE containing a long ice-ufrag triggers the overflow

Reliable exploitation occurs with payloads ≥ ~130 bytes

In practice, ~500+ bytes (e.g., 520) provides consistent crash behavior

Affected Versions

✅ Vulnerable: pjsip ≤ 2.16

❌ Fixed: pjsip ≥ 2.17

Patch

The fix introduces proper bounds checking:

if (rem_ufrag->slen >= MAX_USERNAME_LEN ||
    (rem_ufrag->slen + ice->rx_ufrag.slen + 1) >= 512)
{
    return PJ_ETOOBIG;
}

Impact

Denial of Service (DoS) via segmentation fault Potential for Remote Code Execution (RCE) depending on:

Stack protections (ASLR, NX, canaries) Memory layout Exploit sophistication

1.200.000 Machines affected

Shodan link : https://www.shodan.io/search?query=pjmedia

Proof of Concept (PoC)

The provided PoC sends a crafted SIP INVITE containing an oversized ice-ufrag to trigger the overflow.

Features

Fully synchronous (no asyncio) Command-line configurable Automatic retries Realistic SDP payload Crash detection via timeout

Running the Vulnerable Server

Start pjsua with ICE enabled:

pjsua-x86_64-unknown-linux-gnu --use-ice --local-port=5060 --log-level=5 --no-tcp --auto-answer=200

Running the PoC

python3 pjsip.py -i <target_ip> -p 5060 -a 3

Arguments
Option	Description	Default
-i, --ip	Target IP address	127.0.0.1
-p, --port	SIP port	5060
-a, --attempts	Number of attempts	3
Expected Behavior
Vulnerable Target
No response from server

Mitigation

Upgrade to pjsip ≥ 2.17

Apply input validation for SDP attributes

Use stack protections: Stack canaries ASLR NX (non-executable stack)

Disclaimer

This Proof of Concept is provided for educational and security research purposes only.

Do not use this code against systems you do not own or have explicit permission to test.

Authors

V.Nos

BinSmasher Team