CVE-2026-57159

Executive Summary

CVE-2026-57159 is a memory-corruption vulnerability in the PJSIP multimedia communication library (written in C) affecting the SDP (Session Description Protocol) negotiator component. A remote attacker able to deliver a crafted SDP offer or answer can trigger an out-of-bounds read and write via the assign_pt_and_update_map() function in pjmedia/src/pjmedia/sdp_neg.c, which indexes fixed-size internal payload-type tables using unsanitized payload-type numbers extracted from remote SDP messages. The vulnerability is only reachable when the PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP compile-time feature is enabled — an interoperability option that is disabled by default, meaning unmodified default builds are not affected. Products integrating PJSIP that enable this feature for remote payload-type map maintenance are exposed to memory corruption and denial-of-service (DoS) conditions; remote code execution has not been demonstrated. The upstream fix is commit 673b978.

Technical Analysis

PJSIP is a free and open-source multimedia communication library written in C, widely embedded in VoIP/SIP stacks, real-time communication applications, and communication endpoints. The vulnerable code path resides in the SDP negotiator module, specifically within the file pjmedia/src/pjmedia/sdp_neg.c, in the function assign_pt_and_update_map().

Vulnerability Class & Mechanism: The flaw is a classic CWE-129 — Improper Validation of Array Index. The SDP negotiation process parses payload-type (PT) numbers embedded in remote SDP offer/answer messages. These payload-type values — which in the RTP/SDP ecosystem are typically small integers (0–127 for RTP payload types, but may be dynamically negotiated within certain ranges) — are used by assign_pt_and_update_map() to index into fixed-size internal lookup tables that track the remote payload-type mapping state. When the remote payload-type map maintenance feature is enabled (PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP), the function uses the attacker-supplied PT numbers as array indices without sufficient bounds validation (or with bounds checks that can be bypassed via the specific PT-range constraints used by the SDP/RTP specification).

Attack Surface: The attack vector is purely network-based. An attacker does not need any local access or authentication. The attack is delivered through a standard SIP/SDP exchange — i.e., a malicious SDP body embedded in a SIP INVITE (offer), SIP 200 OK response (answer), SIP UPDATE, or re-INVITE. Any element of the PJSIP stack that performs SDP negotiation (the SDP negotiator) is potentially exposed, provided the target application has compiled the library with the relevant feature macro enabled.

Root Cause Analysis (per NVD description): The flaw is a remote out-of-bounds read and write. The OOB read occurs when the implementation reads from fixed-size internal tables at offsets derived from malicious PT numbers; the OOB write occurs when assign_pt_and_update_map() updates table entries (e.g., writing mapping state, stored negotiated PT values, or reference-counting information) at those same attacker-controlled offsets. Because the write is out-of-bounds, adjacent heap/global memory belonging to other SDP negotiation state structures can be corrupted. The practical demonstrated consequences are memory corruption and denial of service (crash, assertion failure, or heap corruption leading to process termination). Code execution is noted in the description as not demonstrated — this does not preclude it in principle (classical OOB write primitives can sometimes be leveraged for code execution under the right heap layout, but no such technique has been published for this CVE).

Patch Information: The upstream project patched the issue in commit 673b978. The NVD description does not specify the exact code change (e.g., whether bounds checks were added prior to table indexing, whether payload-type validation was added at the SDP parse layer, or whether the feature was deprecated). No release version number is given in the available data.

Configuration Dependency — Critical: This vulnerability is NOT exploitable in default builds. The PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP macro is disabled by default. It is documented as an interoperability option that integrating products may enable to work around remote endpoints that do not strictly follow RFC 3264 (e.g., endpoints that reuse payload-type numbers across media streams/sessions in non-compliant ways). Therefore, the real-world affected population is a subset of PJSIP integrations that chose to enable this feature.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-57159. The attack chain below is inferred strictly from the NVD Description and the vulnerability class (CWE-129 — Out-of-bounds access due to array index validation failure).

1. Reconnaissance / Target Identification: The attacker must identify a network service that uses PJSIP with the remote payload-type map maintenance feature enabled. Because the vulnerability is disabled by default, blanket sweeping of SIP services will only hit vulnerable targets when the specific integration enabled the feature. Reconnaissance may entail:

• SIP service discovery via port 5060 (UDP/TCP) scanning or SIP OPTIONS/ping probes.
• Fingerprinting the target's SIP stack (SIP Server: headers, User-Agent: strings, and SDP response behavior can sometimes reveal PJSIP usage).
• Optionally, application-level fingerprinting to infer whether the remote PT map maintenance feature is enabled — e.g., by sending SDP offers with unusual payload-type numbers and observing whether the peer responds without rejecting the negotiation (indicating the feature is active) versus rejecting with 488 Not Acceptable Here or a 400/488.

2. Triggering the Vulnerability: The attacker crafts a malicious SDP offer (or answer, depending on the attacker's role in the dialog) that contains payload-type numbers deliberately outside the range expected by the fixed-size internal lookup tables, or within the "acceptable but dangerous" range that is not bounds-checked. The SDP body is embedded in a SIP message (INVITE, re-INVITE, UPDATE, or 200 OK within an established dialog). The remote PJSIP stack, processing the SDP through its negotiator, calls assign_pt_and_update_map(). The function reads the PT number from the SDP and uses it to index into the fixed-size internal table. With insufficient bounds validation, an index outside the table's allocated range is accepted.

3. Payload / Execution Method (Vulnerability-Class Level): At a class level, this is a memory-safety flaw in a C library (PJSIP is written in C, not memory-safe). Typical exploitation techniques for CWE-129 with out-of-bounds write include:

• Arbitrary heap corruption: By choosing PT numbers that make the OOB write land in adjacent heap structures (e.g., other SDP media stream state, codec info structures, or the SIP transaction state), the attacker can corrupt pointers, lengths, or flags. Controlled heap corruption in C can be leveraged for arbitrary write primitives if the attacker can influence subsequent memory allocations.
• Denial of Service (primary, demonstrated): Triggering an OOB read that crosses into an unmapped page (segfault) or an OOB write that corrupts critical bookkeeping leading to assertion failure or double-free. The NVD description explicitly states memory corruption and DoS are the practical impacts.

Specific payload construction details (exact PT-number ranges, table sizes, offset-to-corruption distances) are not available in the published data and would require access to the fixed-size table definitions in sdp_neg.c.

4. Post-Exploitation Impact:

• Immediate: Process crash or service hang of the affected PJSIP endpoint (VoIP gateway, softphone, SIP proxy, media server). Repeated exploitation can sustain a DoS condition.
• Extended (hypothetical, not demonstrated): If the OOB write is refined into a controlled write primitive, it could potentially lead to memory disclosure (via OOB read) or code execution in the context of the PJSIP process. The NVD description explicitly notes code execution is not demonstrated, so this remains theoretical.

Important caveat: Because the feature is disabled by default, the attack chain in step 1 (identifying vulnerable targets) is a significant hurdle; the attacker cannot assume default PJSIP deployments are vulnerable. The vulnerability is only reachable in products that explicitly enabled the interoperability flag at build time.

Impact Assessment

Business Impact: For affected deployments (PJSIP integrations with PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP enabled), the primary impact is availability — a remote, unauthenticated attacker can cause denial of service by sending crafted SDP in SIP signaling. For VoIP infrastructure (session border controllers, media gateways, softswitch platforms, embedded communication devices), a crash of the signaling/negotiation process can drop active calls, interrupt call routing, and — if the process is central to registration or call control — create cascading service outages across an enterprise telephony footprint.

Confidentiality / Integrity: Not directly demonstrated. The OOB read could theoretically leak memory contents from the PJSIP process if the attacker can position sensitive data (e.g., SIP credentials, session keys, call metadata) adjacent to the vulnerable table, but no such leak has been published. Similarly, OOB write could permit state corruption that results in call hijacking or media rerouting in a sophisticated attack, but no such technique is proven.

CVSS: No CVSS score has been assigned (vector: N/A). From a qualitative perspective — network-reachable, no authentication, availability impact, but only on non-default configurations — this would likely rate in the Medium-to-High range (CVSS ~6.5–7.5) if scored, but this is our analytical estimate and must not be treated as an official score.

Blast Radius: The affected population is the subset of PJSIP users/integrators that enabled this undocumented (or sparsely documented) interoperability macro. Publicly deployed SIP stacks that ship with default PJSIP configuration are NOT affected. Enterprise security teams should inventory their communication products and check with vendors whether PJSIP with the remote PT map feature was compiled in.

EPSS / KEV: Not yet scored by FIRST; not on CISA KEV. No evidence of exploitation in the wild.

Detection Guidance

Detection of this vulnerability is challenging because the trigger is a valid-looking SDP message that differs from benign SDP only in numeric payload-type values. Network-level detection must focus on abnormal payload-type values in SDP bodies within SIP traffic. Host-level detection focuses on crash indicators in PJSIP processes that may correlate with SDP processing.

Sigma Rule

title: PJSIP SDP Negotiator OOB Access - Abnormal Payload-Type Values
id: 9a8b7c6d-5e4f-4a3b-9c2d-1e0f9a8b7c6d
status: experimental
description: Detects SDP payload-type values outside the valid 0-127 RTP range or at boundary values that may trigger out-of-bounds table access in PJSIP sdp_neg.c (CVE-2026-57159)
author: Valtersit Threat Intelligence
logsource:
    category: application
    product: firewall
    service: sip
detection:
    selection_sip:
        protocol: sip
    selection_sdp_pt:
        # Look for SDP payload-type declarations outside normal dynamic RTP range
        # This is heuristic: legitimate dynamic PTs are typically 96-127
        # Values 0-95 are static PTs; values > 127 are invalid per RFC 3551
        sdp_pt: ">127"           # Values above the 7-bit RTP payload-type space
    selection_high_dynamic:
        # Suspicious high-edge values often used to probe boundaries
        sdp_pt: ">=124"
    condition: selection_sip and (selection_sdp_pt or selection_high_dynamic)
falsepositives:
    - Non-compliant legacy VoIP equipment using PT values above 127 (rare)
    - Proprietary RTP extensions
level: medium
tags:
    - attack.t1190
    - cve.2026-57159

YARA Rule

rule CVE_2026_57159_PJSIP_SDP_Negotiator_PT_Map {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects PJSIP binary artifacts containing the vulnerable assign_pt_and_update_map function with the remote PT map feature enabled"
        cve = "CVE-2026-57159"
        date = "2026-01-01"
        severity = "high"
    strings:
        // Function name string in debug builds or symbol tables (PJSIP ships with symbol names)
        $func_name = "assign_pt_and_update_map"
        // Filename path string for sdp_neg.c compiled into debug info
        $file_path = "pjmedia/src/pjmedia/sdp_neg.c"
        // Configuration macro name if compiled in and present as a string constant
        $feature_macro = "PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP"
        // PJSIP SDP negotiator module name string (likely present in the binary)
        $mod_name = "sdp_neg"
        // Common PJSIP version string format
        $ver_string = "PJSIP" 
    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464c457f  // PE or ELF binary
        and 2 of them
}

Suricata IDS Rule

alert sip any any -> any any (msg:"CVE-2026-57159 PJSIP SDP Negotiator OOB Access - Out-of-Range Payload-Type"; 
flow:to_server,established;
content:"INVITE"; nocase;
content:"m="; nocase; distance:0;
pcre:"/a=rtpmap:(\d{3,})[^0-9]/";  # Matches PT numbers with 3+ digits (> 127)
sid:2026571591; rev:1; 
metadata:attack_target Sip, deployment Perimeter, cve CVE-2026-57159, signature_severity Major, created_at 2026_01_01;
reference:url, https://nvd.nist.gov/vuln/detail/CVE-2026-57159;)

Elastic Detection

// EQL query for detecting abnormal SDP payload-type values in captured SIP traffic (Packetbeat/Filebeat)
sequence by source.ip
  [ network where network.protocol == "sip" and 
    // crude check: look for SDP "a=rtpmap:" lines followed by suspicious large numbers
    // Exact field availability depends on the SIP dissector in use
    sip.body : "*a=rtpmap:1[3-9][0-9]*" or 
    sip.body : "*a=rtpmap:[2-9][0-9][0-9]*" ]
  [ process where event.action == "crash" and process.name : "*pjsip*" ]

Note: EQL event-based matching of SIP body content with PCRE is limited. The rule above is a heuristic that requires a SIP-aware ingest pipeline exposing sip.body.

Splunk SPL Query

index=* sourcetype="cisco:asa" OR sourcetype="pan:traffic" OR sourcetype="sip"
| rename src_ip as Attacker, dest_ip as Target
| where match(_raw, "a=rtpmap:\d{3,}") OR match(_raw, "a=rtpmap:1[3-9][0-9]")
| stats count by Attacker, Target, _time
| eval suspicious_pt_count = count
| where suspicious_pt_count > 5
| table _time, Attacker, Target, suspicious_pt_count

Wazuh OSSEC Rule

<group name="sip,pjsip,cve-2026-57159,">
  <rule id="985662" level="10">
    <if_sid>57150</if_sid>
    <match>a=rtpmap:\d{3,}</match>
    <description>CVE-2026-57159: Out-of-range SDP payload-type detected in SIP traffic, potential PJSIP sdp_neg.c out-of-bounds access attempt.</description>
    <group>pjsip,sip,attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
    <alert_email>soc@valtersit.com</alert_email>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED per our sources (no patch evidence from any tracked source beyond the NVD-provided commit reference).

Important distinction: The NVD description explicitly states the issue "has been patched via commit 673b978", meaning upstream PJSIP has a fix in its development repository. However, our tracked patch sources do not yet confirm a release containing this commit, nor a vendor advisory. Security teams should treat the fix as available in the upstream git history but not necessarily shipped in a stable release.

1. Immediate Mitigations (if you cannot upgrade immediately):

• Disable the feature (highest-impact, lowest-effort mitigation): If your integration enabled PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP at build time, rebuild PJSIP without this macro. This eliminates the vulnerable code path entirely. For most integrations, this option is an interoperability convenience rather than a hard requirement — test that your media negotiation still works with compliant peers.
• Network-level filtering: If disabling the feature is not immediately possible (e.g., binary-only appliance), deploy an application-layer SIP firewall / SBC that can enforce RFC 3551/3264 compliance — rejecting SDP payload-type values outside the valid 0–127 range before they reach the PJSIP stack.
• Access control: Restrict SIP signaling access to trusted peers only (IP allow-listing, TLS/mTLS for SIP over TLS, authentication on SIP INVITE/dialog establishment) so that only authenticated entities can send SDP.
• Monitoring: Deploy the detection rules above to catch anomalous SDP payload-type numbers. Watch PJSIP process crash rates / core dumps for signs of attempted exploitation.

2. Patch/Upgrade Steps:

• Primary action: Update PJSIP to a release that includes commit 673b978. If no stable release yet contains this commit, check the PJSIP project's release schedule or contact the maintainers. For organizations building from source, applying commit 673b978 directly to your local tree is the definitive fix.
• Vendor coordination: If you use PJSIP through a third-party product (SBC, softphone, media gateway, embedded device), contact the product vendor immediately. Ask whether they compile with PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP enabled, and request a patched firmware/software build. The risk is entirely in the vendor's build configuration.
• Post-patch regression test: Verify that the remote payload-type map maintenance feature (if still needed) works correctly against interop peers after the bounds-check fix lands.

3. Long-Term Hardening:

• Configuration audit: Treat PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP as a security-sensitive build option. Establish a process to triage all non-default build flags in third-party libraries against CVE databases. This feature should be explicitly documented in your security architecture with a justification for why it remains enabled.
• Memory-safe language migration: PJSIP is written in C; memory-corruption classes such as CWE-129 are endemic to C. For new projects, consider memory-safe alternatives (e.g., Rust-based SIP stacks) or isolate the PJSIP component into a sandboxed container/process with minimal privileges to reduce the impact of any future memory-corruption vulnerability.
• Continuous monitoring: Add PJSIP and its build configuration to your software inventory (SBOM). Ensure that any future CVE mentioning a non-default compile flag is prioritized against your actual build configuration, not just the library version number.
• Network segmentation: Place SIP/real-time media processing on dedicated segments with strict ingress filtering, reducing the number of hosts that can reach the PJSIP service from untrusted networks.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-57159 — Official CVE record (details used in this report).
2. PJSIP Project Repository: https://github.com/pjsip/pjproject — Upstream source; commit 673b978 is the authoritative patch reference. (Verify the commit exists in your git clone: git show 673b978.)
3. MITRE CWE-129: https://cwe.mitre.org/data/definitions/129.html — Improper Validation of Array Index (vulnerability class reference).
4. PJSIP SDP Negotiation Documentation: https://docs.pjsip.org/ — Reference for the PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP option and SDP negotiation internals (for context on the affected component).

Known threat actor campaigns / in-the-wild evidence: None reported. No exploit code, PoC, or campaign has been attributed to CVE-2026-57159 as of this writing. CISA KEV does not list this CVE. Given that the vulnerable feature is disabled by default, real-world exploitation would require a deliberate (and likely uncommon) build configuration in the target, reducing the likelihood of broad automated exploitation in the near term.