CVE-2026-57163

Executive Summary

CVE-2026-57163 is a stack-based buffer overflow (CWE-121) in the GnuTLS TLS backend of PJSIP, a widely deployed open-source multimedia communication library written in C. The flaw resides in the certificate-information extraction path (tls_cert_get_info() in ssl_sock_gtls.c) and is triggered while parsing the Subject Alternative Name extension of a peer certificate during the TLS handshake — before any SIP-level authentication is performed. Only builds compiled with GnuTLS (--with-gnutls) are affected; OpenSSL and Apple SecureTransport/Network.framework builds are not. With a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), a network-positioned attacker presenting a crafted certificate can cause memory corruption potentially leading to control-flow hijack, though no public exploit currently exists and EPSS is low (0.00252, ~16.7th percentile).

Technical Analysis

PJSIP uses a modular TLS abstraction layer, allowing the library to be linked against different TLS implementations. The affected configuration is the GnuTLS backend, selected at build time via --with-gnutls. A distinct code path handles certificate information retrieval for this backend, implemented in ssl_sock_gtls.c as tls_cert_get_info().

After a TLS handshake completes, PJSIP extracts identifying data from the peer certificate — including entries contained in the Subject Alternative Name (SAN) extension. During this extraction, the vulnerable code computes or uses an incorrect buffer-size value. When a SubjectAltName entry is larger than expected, the code writes beyond the bounds of a fixed-size stack buffer, producing a classic stack buffer overflow (CWE-121). The root cause is an inaccurate buffer-size accounting during SAN parsing, not a flaw in GnuTLS itself.

Key characteristics of the attack surface:

• Trigger point: The TLS handshake and the subsequent certificate-information extraction — well before SIP REGISTER, INVITE, or digest authentication logic executes.
• Attacker position: Network-positioned. It can be exploited in two directions — a malicious server presenting a crafted certificate to a connecting PJSIP client, or a malicious client presenting a crafted certificate to a PJSIP server that has requested client certificates (mutual TLS).
• Backend specificity: Only GnuTLS builds are vulnerable. OpenSSL and Apple SecureTransport/Network.framework builds do not share this code and are unaffected.
• Precondition: The vulnerable code must be reached, meaning certificate-information extraction must be invoked after the handshake. The NVD description states this occurs "while extracting certificate information after a TLS handshake."

The NVD description does not specify the exact size of the fixed stack buffer, the precise SAN field that overflows it, or the exact arithmetic error in the size calculation. These implementation specifics should not be assumed; they are fixable only by reviewing commit c4a151a directly. What is stated unambiguously is: an oversized SAN entry is written past the end of a fixed-size stack buffer due to an incorrect buffer-size value, yielding stack memory corruption.

Note on exploitability: The CVSS vector assigns Integrity:High and Availability:High but Confidentiality:None, which is consistent with a memory-corruption write primitive that corrupts control data (affecting integrity and availability) without a stated information-disclosure path. Because the overwrite is triggered by attacker-controlled certificate bytes parsed before authentication, the AC:L/PR:N/UI:N metrics reflect that no privileges or user interaction are required once a TLS connection is established.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code exists for this CVE. The following chain is inferred strictly from the vulnerability class and the NVD description; no implementation details beyond the named function (tls_cert_get_info()), file (ssl_sock_gtls.c), and commit (c4a151a) are asserted.

1. Reconnaissance / target identification. An attacker identifies a SIP endpoint built with PJSIP and compiled against GnuTLS. This can be inferred from exposed TLS services, banner/service fingerprints, or knowledge of the target's deployment (e.g., SIP proxies, softphones, or embedded VoIP appliances using PJSIP). GnuTLS-backed builds must be distinguished from OpenSSL builds, since the latter are not affected.

2. Triggering the specific flaw class. The attacker positions themselves as either:

   • a malicious server to which a PJSIP client connects, or
   • a malicious client presenting a certificate to a PJSIP server configured to request client certificates. The attacker constructs a certificate whose Subject Alternative Name extension contains an oversized entry. When the TLS handshake completes and PJSIP calls into tls_cert_get_info() to extract certificate information, the incorrect buffer-size value causes the oversized SAN data to be written past the end of the fixed-size stack buffer.

3. Payload / execution at the vulnerability-class level. This is a stack buffer overflow. The attacker-controlled certificate bytes are written beyond the buffer boundary, overwriting adjacent stack memory. At the level of vulnerability class, this provides a memory-corruption primitive that may corrupt local variables, saved state, or return-related control data on the stack. No specific exploitation technique (e.g., ROP chain construction) can be described because the description does not disclose the buffer size, overflow offset, or overwrite target.

4. Post-exploitation impact. Depending on which stack data is overwritten and whether the corruption is precisely controllable, outcomes range from a crash (unexpected application termination / denial of service) to memory corruption enabling control-flow hijack, as stated in the NVD description. Because the trigger occurs during/after the TLS handshake and before SIP-level authentication, the attacker does not need valid SIP credentials.

Impact Assessment

• CVSS 3.1 base: 9.1 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
  • AV:N — exploitable across a network via a TLS connection.
  • AC:L — no special conditions; a crafted certificate triggers it.
  • PR:N — no privileges required; triggered pre-authentication.
  • UI:N — no user interaction required.
  • S:U — impact scope confined to the vulnerable component.
  • C:N — no confidentiality impact stated.
  • I:H — high integrity impact (memory corruption / control-flow hijack).
  • A:H — high availability impact (crash / termination).
• Blast radius: Any PJSIP-based application, library consumer, softphone, SIP server, or embedded VoIP device compiled with --with-gnutls. Notably, OpenSSL and Apple SecureTransport/Network.framework builds are NOT affected, materially narrowing the population of vulnerable deployments.
• Exploit maturity: No public PoC or exploit code is available; EPSS is 0.00252 (16.7th percentile). CISA KEV does not list this CVE, indicating no confirmed exploitation in the wild at time of writing.
• Business impact: VoIP/SIP infrastructure is often internet-exposed and business-critical. A pre-authentication memory-corruption flaw in a communications library can disrupt call routing and signaling, and — in the worst case — provide a foothold on telephony gateways, which are high-value targets for toll fraud, eavesdropping, and lateral movement.

Detection Guidance

Sigma Rule

title: PJSIP GnuTLS Certificate SAN Parsing Buffer Overflow Attempt (CVE-2026-57163)
id: 8f3c1a92-7d4e-4b21-9c6a-2e5b0f1a7d33
status: experimental
description: Detects process crashes or TLS handshake failures in PJSIP/GnuTLS builds potentially indicative of CVE-2026-57163 exploitation via crafted SubjectAltName entries.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-57163
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-57163
logsource:
  category: application
  product: pjsip
detection:
  selection_proc:
    Image|endswith:
      - 'pjsua'
      - 'pjsua2'
      - 'asterisk'
  selection_crash:
    EventID:
      - 1000
      - 1001
    Provider_Name: 'Application Error'
  selection_terms:
    - 'ssl_sock_gtls'
    - 'tls_cert_get_info'
    - 'stack buffer overflow'
    - 'gnutls'
  condition: selection_proc and (selection_crash or selection_terms)
falsepositives:
  - Legitimate application crashes unrelated to TLS parsing
  - Debug builds emitting verbose TLS backend messages
level: high

YARA Rule

rule CVE_2026_57163_PJSIP_GnuTLS_SAN_Overflow
{
    meta:
        description = "Detects PJSIP GnuTLS builds referencing the vulnerable certificate-info extraction path (CVE-2026-57163)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-57163"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $f1 = "tls_cert_get_info" ascii
        $f2 = "ssl_sock_gtls.c" ascii
        $f3 = "SubjectAltName" ascii nocase
        $gnutls = "gnutls" ascii nocase

    condition:
        (uint32(0) == 0x464c457f or uint16(0) == 0x5a4d) and
        ($f1 or $f2) and
        ($f3 or $gnutls)
}

Suricata IDS Rule

alert tls any any -> any any (msg:"CVE-2026-57163 PJSIP GnuTLS Certificate SAN Parsing Buffer Overflow Attempt"; flow:established,to_server; tls.store; content:"|55 1d 11|"; tls.cert_subject; reference:cve,2026-57163; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-57163; classtype:attempted-admin; sid:202657163; rev:1;)

Elastic Detection

process where event.type == "start" and process.name : ("pjsua", "pjsua2", "asterisk", "pjproject") and
  process.command_line : ("*gnutls*")

Splunk SPL Query

index=main (source="*pjsip*" OR source="*pjsua*" OR source="*asterisk*")
| search ("ssl_sock_gtls" OR "tls_cert_get_info" OR "gnutls" OR "SIGSEGV" OR "stack buffer overflow")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process, message
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="pjsip,cve-2026-57163,">
  <rule id="202671630" level="12">
    <decoded_as>json</decoded_as>
    <field name="program">pjsua|pjsua2|asterisk</field>
    <match>ssl_sock_gtls|tls_cert_get_info|gnutls|stack buffer overflow</match>
    <description>CVE-2026-57163: PJSIP GnuTLS certificate SAN parsing buffer overflow attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_57163,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 — LIKELY — 2 independent sources (NVD, OSV) confirm fix.

1. Immediate mitigations:

   • If you cannot immediately upgrade, rebuild PJSIP against OpenSSL (or use Apple SecureTransport/Network.framework builds on Apple platforms) instead of GnuTLS. These backends do not contain the vulnerable tls_cert_get_info() path in ssl_sock_gtls.c and are explicitly noted as unaffected.
   • Reduce exposure: do not terminate untrusted TLS connections with GnuTLS-backed PJSIP instances where avoidable; restrict inbound TLS to trusted peers via network controls.
   • Enforce strict certificate validation and pinning where operationally possible to limit acceptance of attacker-crafted certificates.
   • Apply ASLR/stack canaries and runtime hardening on hosts running PJSIP — these do not fix the flaw but raise exploitation difficulty.

2. Patch / upgrade steps:

   • Upgrade to a PJSIP build that includes commit c4a151a, which patches the stack buffer overflow in tls_cert_get_info().
   • If building from source, apply commit c4a151a or later and rebuild cleanly; if you track a downstream distribution, obtain the vendor build that has incorporated this commit.
   • Verify the resulting binary was compiled with the intended TLS backend and that the fix commit is present.

3. Long-term hardening:

   • Standardize certificate-parsing code paths on fuzz-tested, memory-safe TLS libraries and introduce continuous fuzzing of certificate/SAN parsing.
   • Prefer memory-safe languages or enable memory-safety compiler flags (-fstack-protector-strong, -D_FORTIFY_SOURCE=2) for C components.
   • Track upstream PJSIP commits and security-relevant changes; treat certificate-handling code as security-critical.
   • Segment and monitor SIP/VoIP infrastructure; monitor for anomalous TLS handshake failures and application crashes.

References

• NVD — CVE-2026-57163: https://nvd.nist.gov/vuln/detail/CVE-2026-57163
• OSV — CVE-2026-57163: https://osv.dev/vulnerability/CVE-2026-57163
• PJSIP Project / Fix commit c4a151a: https://github.com/pjsip/pjproject (repository — commit c4a151a)
• CWE-121 (Stack-based Buffer Overflow): https://cwe.mitre.org/data/definitions/121.html
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild evidence: None reported. CISA KEV does not list CVE-2026-57163, EPSS is 0.00252, and no public PoC, exploit code, or Nuclei template is available at the time of writing. The patch is confirmed by NVD and OSV with LIKELY confidence.