CVE-2026-57160

Executive Summary

CVE-2026-57160 is an off-by-one out-of-bounds write (CWE-193) in pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c, the function that serializes generic array headers such as Allow, Require, Supported, and Unsupported. It is reachable primarily in SIP intermediary roles — proxies, SBCs, and B2BUAs — that parse incoming SIP requests and re-serialize them, allowing a remote, unauthenticated peer to influence the serialized message and trigger a one-byte overwrite past the end of the output buffer. Impact is rated Low on integrity only (CVSS 5.3); code execution and information disclosure are not demonstrated, and in typical pool-based allocations the stray byte lands within allocation slack.

Technical Analysis

PJSIP is a free and open source multimedia communication library written in C, widely embedded in SIP stacks, softphones, gateways, and carrier infrastructure. The flaw resides in the header serialization path for "generic array" headers. SIP defines several headers whose values are comma-separated lists of tokens: Allow, Require, Supported, and Unsupported. PJSIP models these with a shared generic-array header type, and pjsip_generic_array_hdr_print() renders that structure back into wire format when a message is serialized for transmission.

The defect is a boundary-condition error: under "certain output-buffer boundary conditions," the function writes one byte beyond the end of the buffer. The mechanism is the classic CWE-193 off-by-one — a length or index calculation that permits a terminating or trailing byte to be emitted at an offset one past the allocated region, rather than a length-overflow that yields attacker-chosen writes at arbitrary offsets. Per the NVD description, the write is a single fixed byte; the value is not attacker-selected as a general-purpose primitive.

Reachability is shaped by the serialization model. Applications that merely receive and consume SIP messages may never re-render the affected header, while intermediaries that forward messages must re-serialize them. A proxy, SBC, or B2BUA therefore completes the loop: it parses a remote peer's inbound request, rebuilds the message (including the generic array headers the peer supplied), and writes it to a network or memory buffer. The remote peer's control over the contents and length of Allow/Require/Supported/Unsupported values is what places the serializer at the vulnerable boundary.

The practical severity ceiling is set by allocator behavior. PJSIP's memory management is pool-based; allocations are carved from larger pooled blocks, so a one-byte overrun frequently falls into interior allocation slack rather than crossing into a protected page or adjacent heap object metadata. That is consistent with the CVSS assessment: no demonstrated code execution (C:N notwithstanding the absence of a confidentiality vector — the vector scores C:N and I:L only), no demonstrated information disclosure, and an integrity impact limited to the possibility of corrupting the serialized output. The Integrity:L subscore reflects that the trailing byte may alter serialized data or adjacent pool content without a proven exploitation path.

Because no public proof-of-concept, Nuclei template, or exploit code exists, precise triggering inputs are not publicly enumerated. What can be stated with confidence from the advisory: the trigger requires an attacker-influenced generic array header, a serialization event, and an output buffer whose length lands exactly at the off-by-one boundary. Absent a released version tag, affected builds are those that predate commit d6a0e7f.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (off-by-one write in a message serializer) and the advisory's stated reachability conditions. No function names, endpoints, or parameters beyond those in the NVD description are asserted.

1. Reconnaissance / target identification. An adversary identifies exposed SIP infrastructure — SIP proxies, SBCs, or B2BUAs — that embed PJSIP and forward or regenerate SIP messages. SIP services typically listen on UDP/TCP 5060 and TLS 5061. The attacker needs only network reachability to a signaling port; no credentials are required (PR:N), and no user interaction is required (UI:N).

2. Triggering the flaw class. The attacker sends a SIP request containing one or more generic array headers — Allow, Require, Supported, or Unsupported — crafted such that, when the intermediary re-serializes the message, the computed output length lands at the off-by-one boundary. The vulnerability is a boundary-condition class defect, so triggering it is a matter of aligning the serialized header length with the buffer edge rather than supplying a large overflow payload. Because only "certain output-buffer boundary conditions" are cited, the specific length alignment is not publicly documented.

3. Execution method at the vulnerability-class level. The write occurs during header serialization inside pjsip_generic_array_hdr_print(). A single fixed byte is written one position past the end of the output buffer. There is no evidence of an attacker-directed write primitive, format-string behavior, or length-overflow multiplication.

4. Post-exploitation impact. The advisory explicitly states that code execution and information disclosure are not demonstrated and that, under typical pool-based allocations, the overwritten byte falls within allocation slack. Realistic outcomes are therefore limited: potential corruption of pooled memory adjacent to the buffer, a malformed or truncated serialized SIP message, or a process-level fault (crash) if the byte lands on a boundary that the allocator enforces. This maps to the NVD impact triad of low integrity impact with no confirmed confidentiality or availability impact, and to the CVSS 5.3 base score.

Impact Assessment

CVSS 3.1 breakdown (as published): AV:N (network-reachable SIP signaling), AC:L (no specialized conditions beyond the boundary alignment described), PR:N (no authentication), UI:N (no user interaction), S:U (impact confined to the vulnerable component), C:N (no demonstrated disclosure), I:L (single fixed byte written out of bounds may corrupt serialized output or pool slack), A:N (no demonstrated denial of service). Base score 5.3 — Medium.

EPSS: 0.00443, at the 37.4th percentile of scored CVEs. This indicates low modeled near-term exploitation probability, consistent with the absence of public exploit code and with the limited primitive.

Affected systems and blast radius. The exposure is concentrated in signaling intermediaries rather than endpoints: SIP proxies, session border controllers, and B2BUAs built on PJSIP, plus any application that both parses remote SIP messages and re-serializes them. Pure UA endpoints that consume but do not regenerate headers may not be reachable. Because PJSIP is a library rather than a standalone product, the true blast radius depends on downstream integrators' build and deployment choices; no CPE-style affected-version list was published, and OSV reports the package range as unfixed. This uncertainty is itself an operational risk: asset owners may not know whether their embedded stack predates commit d6a0e7f.

Business impact. Limited on its own — no demonstrated RCE, no demonstrated data loss. The main risk is availability-adjacent instability in carrier-grade signaling paths if the boundary byte lands in allocator-enforced territory, degrading VoIP call routing for affected tenants. The vulnerability is also relevant as a chained primitive: a one-byte pool corruption in a long-lived, network-facing process is the kind of defect that becomes materially more dangerous when combined with a separate heap-shaping or allocator-abuse bug. CISA KEV status is NO, so there is no known exploitation in the wild and no federal remediation deadline.

Detection Guidance

Sigma Rule

title: CVE-2026-57160 PJSIP Generic Array Header Serialization Abuse
id: 8f3c1a2e-5716-4b9d-9c0e-6a2f7d4e3b10
status: experimental
description: Detects downstream process crashes in PJSIP-based SIP proxies/SBCs/B2BUAs that correlate with inbound SIP requests carrying Allow/Require/Supported/Unsupported headers, indicating potential off-by-one serialization abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-57160
author: valtersit.com
date: 2026-01-01
logsource:
  category: application
  product: pjsip
detection:
  selection_crash:
    message|contains:
      - 'pjsip_generic_array_hdr_print'
      - 'pjsip/src/pjsip/sip_msg.c'
  selection_signal:
    message|contains|all:
      - 'SIGSEGV'
      - 'pjsip'
  condition: selection_crash or selection_signal
falsepositives:
  - Benign SIP parser assertion failures
  - Debug builds with verbose logging
level: low
tags:
  - attack.t1190
  - cve.2026-57160

YARA Rule

rule CVE_2026_57160_PJSIP_Generic_Array_Hdr_Print
{
    meta:
        author = "valtersit.com"
        description = "Flags PJSIP builds containing the vulnerable generic array header serializer (pre-commit d6a0e7f)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-57160"
        cve = "CVE-2026-57160"
        date = "2026-01-01"

    strings:
        $fn = "pjsip_generic_array_hdr_print" ascii
        $path = "pjsip/src/pjsip/sip_msg.c" ascii
        $hdr1 = "Allow" ascii fullword
        $hdr2 = "Require" ascii fullword
        $hdr3 = "Supported" ascii fullword
        $hdr4 = "Unsupported" ascii fullword

    condition:
        ($fn or $path) and any of ($hdr*)
}

Suricata IDS Rule

alert sip any any -> any 5060 (msg:"CVE-2026-57160 PJSIP Generic Array Header Serialization Probe"; flow:to_server,established; content:"Allow"; nocase; content:"Require"; nocase; content:"Supported"; nocase; reference:cve,2026-57160; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-57160; classtype:attempted-admin; sid:90057160; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)
alert sip any any -> any 5061 (msg:"CVE-2026-57160 PJSIP Generic Array Header Serialization Probe (TLS-SIP)"; flow:to_server,established; content:"Allow"; nocase; content:"Require"; nocase; content:"Supported"; nocase; reference:cve,2026-57160; classtype:attempted-admin; sid:90057161; rev:1;)

Elastic Detection

process where event.action == "crashed" and
  process.name : "*.sip*" and
  process.command_line != null

Or, for signal-level visibility on Linux hosts running PJSIP-based daemons:

process where event.action in ("segfault", "signal") and
  process.name : ("kamailio", "opensips", "*.sbc*", "*.b2bua*", "*pjsip*")

Splunk SPL Query

index=sip OR index=app_logs (sourcetype=sip_proxy OR source="*pjsip*")
| search ("pjsip_generic_array_hdr_print" OR "sip_msg.c" OR ("SIGSEGV" AND "pjsip"))
| stats count min(_time) as first_seen max(_time) as last_seen by host, process_name
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort -count

Wazuh OSSEC Rule

<group name="pjsip,sip,">
  <rule id="100716" level="6">
    <decoded_as>syslog</decoded_as>
    <match>pjsip_generic_array_hdr_print</match>
    <description>CVE-2026-57160: PJSIP generic array header serializer referenced in logs (possible off-by-one trigger)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100717" level="8">
    <decoded_as>syslog</decoded_as>
    <match>pjsip/src/pjsip/sip_msg.c</match>
    <description>CVE-2026-57160: PJSIP sip_msg.c serialization path crash indicator</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100718" level="7">
    <decoded_as>syslog</decoded_as>
    <match>Allow|Require|Supported|Unsupported</match>
    <regex>\.sip_msg\.c|pjsip_generic_array_hdr_print</regex>
    <description>CVE-2026-57160: generic array header processing anomaly in SIP stack</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 — LIKELY. NVD and OSV independently confirm the fix, and the specific commit (d6a0e7f) is identified.

1) Immediate mitigations. Because upstream identifies no vendor workaround, defense rests on boundary controls. Restrict access to SIP signaling ports (UDP/TCP 5060, TLS 5061) to trusted peer ranges using network ACLs or SIP-aware firewalls. Terminate and re-originate untrusted SIP across a hardened border element rather than forwarding raw peer-controlled headers into an internal PJSIP serializer. Where a PJSIP-based process accepts messages from untrusted networks, run it under a supervisor that captures and restarts on crash, and enable core dumps so that any boundary hit is captured for triage. Deploy the detection rules above; because exploitation evidence is invisible on the wire (the primitive is internal to serialization), prioritize host-level crash and signal telemetry over network signatures.

2) Patch / upgrade steps. Update to a PJSIP build that includes commit d6a0e7f. Since no release tag is confirmed, verify the fix is present by checking out or vendoring the commit into the pjsip/src/pjsip/sip_msg.c source tree and rebuilding. If you consume PJSIP via a distribution package, embedded SDK, or a vendor appliance, query the integrator for their d6a0e7f-equivalent patch level — do not assume a version string alone confirms the fix. After upgrade, re-run your SIP interop and proxy forwarding test cycles, with particular attention to Allow/Require/Supported/Unsupported header rendering in proxied and re-originated messages.

3) Long-term hardening. Adopt memory-safe serialization practices and compile intermediaries with FORTIFY_SOURCE, stack/heap canaries, and ASan/UBSan in staging fuzzing. Build a continuous fuzzing harness around SIP message parse-and-reserialize paths using malformed generic array headers at many length boundaries. Maintain an SBOM so embedded PJSIP instances can be located in appliances and containers, and track PJSIP commits rather than relying on release cadence for a project that patches via git. Apply least-privilege and network segmentation to signaling elements so that a single-byte pool corruption cannot be chained into a higher-impact primitive.

References

1. NVD — CVE-2026-57160: https://nvd.nist.gov/vuln/detail/CVE-2026-57160
2. OSV — package advisory for CVE-2026-57160 (PJSIP range reported unfixed): https://osv.dev/vulnerability/CVE-2026-57160
3. PJSIP project repository / commit d6a0e7f (upstream fix, pjsip/src/pjsip/sip_msg.c): https://github.com/pjsip/pjproject
4. MITRE CWE-193 — Off-by-one Error: https://cwe.mitre.org/data/definitions/193.html
5. CISA KEV Catalog (CVE-2026-57160 NOT listed; included for status verification): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor and in-the-wild evidence: None. No public PoC, no Nuclei template, no exploit code, and no CISA KEV listing. EPSS 0.00443 (37.4th percentile) indicates low exploited-in-the-wild likelihood as of this report. Any exploit activity would be inferred rather than observed.