CVE-2026-57165

Executive Summary

CVE-2026-57165 is a stack buffer overflow (CWE-121) in the PJSIP PJLIB-UTIL telnet CLI front-end, specifically in the handle_up_down() function within cli_telnet.c. The flaw is triggered when redrawing the command line during history recall, where the line-redraw sequence can exceed the capacity of a fixed-size stack buffer, potentially leading to application termination. This vulnerability only affects applications that explicitly enable the telnet CLI front-end; exposure is limited because the unauthenticated telnet CLI already permits arbitrary CLI command execution, so the incremental security impact is constrained to denial-of-service (availability) rather than code execution or data compromise.

Technical Analysis

PJSIP is a free, open-source multimedia communication library written in C, widely used in VoIP, SIP, and real-time communication stacks. The PJLIB-UTIL component provides utility functions, including a telnet-based CLI front-end that allows remote administration and command execution over an unauthenticated telnet session (when enabled).

The vulnerability resides in handle_up_down() within cli_telnet.c. This function handles terminal input for arrow-key navigation, including history recall (up/down arrow). During a history recall, the CLI must redraw the current command line — erasing the previous line and writing the recalled history entry. The redraw sequence builds output data into a fixed-size stack buffer. If a recalled history entry is longer than expected (or the redraw sequence accumulates more data than the buffer can hold), the write exceeds the buffer bounds — a classic stack buffer overflow (CWE-121).

Key technical facts from the description:

• The overflow occurs specifically during "line-redraw sequence for a recalled history entry."
• The buffer is fixed-size and stack-allocated.
• The failure mode described is application termination (crash/DoS), consistent with stack corruption detected by stack canaries or resulting in a SIGSEGV.
• Exploitation requires access to the unauthenticated telnet CLI.
• The telnet CLI already allows arbitrary CLI commands, so an attacker with telnet access already possesses significant control — the additional impact of this overflow is therefore limited.
• Applications that do not enable the telnet CLI front-end are not affected.

Attack surface: network-reachable telnet service exposed by the application embedding PJSIP's PJLIB-UTIL CLI. The vulnerability is in the history-recall rendering path, not in command parsing or execution.

Note: The NVD description does not specify the exact buffer size, the precise overflow condition threshold, or the exact byte sequence required. Those details would require source review of commit 628b716. No public PoC or exploit code is available.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (stack buffer overflow in a TUI redraw path) and the constraints stated in the NVD description.

1. Reconnaissance / target identification — An attacker scans for exposed telnet services associated with PJSIP-based applications (e.g., port 23 or a configured CLI port) and confirms the PJLIB-UTIL telnet CLI front-end is active. Because the CLI is unauthenticated, banner/behavior fingerprinting is sufficient.

2. Triggering the flaw class — The attacker connects to the telnet CLI and drives the history-recall path: submitting a command (to populate history) and then repeatedly issuing the "up" arrow / history navigation sequence. The handle_up_down() redraw logic is invoked on each recall. If the recalled entry causes the redraw sequence to exceed the fixed-size stack buffer, an out-of-bounds stack write occurs. At the vulnerability-class level, this is a stack-based buffer overflow triggered by input length exceeding a compile-time buffer bound.

3. Payload / execution method — At the vulnerability-class level, the attacker supplies an over-long history entry (or sequences recalls) such that the redraw output surpasses the buffer. The description indicates the practical consequence is application termination rather than reliable code execution; memory corruption outcomes beyond a crash are not established by the available data.

4. Post-exploitation impact — Because the telnet CLI is already unauthenticated and permits arbitrary CLI commands, the attacker's primary incremental gain from this overflow is denial of service — crashing the application/process running the CLI. No privilege escalation, data exfiltration, or code-execution impact is documented.

Impact Assessment

CVSS 3.1 base score: 5.3 (Medium) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

• Confidentiality (C:N): No impact.
• Integrity (I:N): No impact.
• Availability (A:L): Low impact — application termination possible.
• Attack Vector (AV:N): Network-exploitable via the telnet CLI.
• Attack Complexity (AC:L): Low; no special conditions beyond enabling the CLI.
• Privileges Required (PR:N): None — the telnet CLI is unauthenticated.
• User Interaction (UI:N): None required.
• Scope (S:U): Unchanged.

Business impact: PJSIP is embedded in VoIP gateways, SIP proxies, softswitches, and unified communications platforms. Systems that enable the telnet CLI front-end and expose it to untrusted networks face a DoS risk (process crash, dropped calls, service unavailability). Because the CLI is already unauthenticated and permits arbitrary commands, the incremental risk is modest for confidentiality/integrity but real for availability and operational stability. EPSS is 0.00357 (29.0th percentile), indicating low predicted exploitation likelihood. Not listed in CISA KEV. No known exploit-in-the-wild.

Blast radius: Limited to deployments with the PJLIB-UTIL telnet CLI front-end explicitly enabled and network-reachable. Default-disabled configurations are not affected.

Detection Guidance

Detection should focus on abnormal telnet CLI usage — especially rapid/repeated history-navigation keystrokes (ESC [A / ESC [B sequences) and connection patterns consistent with buffer-overflow attempts against the CLI.

Sigma Rule

title: PJSIP PJLIB-UTIL Telnet CLI History-Recall Buffer Overflow Attempt
id: 3f9a7c21-2b6d-4e58-9c11-a1b2c3d4e5f6
status: experimental
description: Detects telnet client sessions that send repeated history-recall
  escape sequences (arrow up/down) consistent with triggering CVE-2026-57165
  stack buffer overflow in handle_up_down() (cli_telnet.c).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-57165
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/telnet'
      - '/nc'
      - '/ncat'
    CommandLine|contains: '23'
  selection_escape:
    CommandLine|contains|all:
      - '\x1b[A'
      - '\x1b[B'
  condition: selection_proc and selection_escape
falsepositives:
  - Legitimate interactive telnet CLI administration
level: low

YARA Rule

rule CVE_2026_57165_PJSIP_Telnet_CLI_Redraw_Overflow
{
    meta:
        description = "Detects PJSIP cli_telnet.c history-recall redraw pattern associated with CVE-2026-57165"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-57165"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $fn     = "handle_up_down" ascii wide
        $file   = "cli_telnet.c"  ascii wide
        $hist   = "history"        ascii nocase
        $redraw = "redraw"         ascii nocase

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        ( $fn or ( $file and any of ($hist, $redraw) ) )
}

Suricata IDS Rule

alert tcp any any -> any 23 (
  msg:"CVE-2026-57165 PJSIP PJLIB-UTIL Telnet CLI history-recall overflow attempt";
  flow:established,to_server;
  content:"|1B 5B 41|";       # ESC [ A  (up arrow)
  content:"|1B 5B 41|";       # repeated up-arrow navigation
  threshold: type both, track by_src, count 20, seconds 5;
  classtype:attempted-dos;
  reference:cve,2026-57165;
  sid:10057165;
  rev:1;
)

Elastic Detection

sequence by source.ip with maxspan=10s
  [network where network.transport == "tcp" and destination.port == 23 and
    process.name in ("telnet","nc","ncat")]
  [network where network.transport == "tcp" and destination.port == 23 and
    network.protocol == "telnet" and event.outcome == "success"]

Splunk SPL Query

index=network OR index=firewall
| search (dest_port=23 OR dest_port=2323)
| rex field=payload "(?<esc>\x1b\[[AB])"
| where isnotnull(esc)
| stats count AS nav_events, dc(src) AS sources BY src, dest
| where nav_events > 20
| table _time, src, dest, nav_events, sources

Wazuh OSSEC Rule

<group name="pjsip,telnet,">
  <rule id="100571" level="10">
    <decoded_as>json</decoded_as>
    <field name="dest_port">^23$</field>
    <match>CVE-2026-57165|cli_telnet|handle_up_down|history recall</match>
    <description>PJSIP PJLIB-UTIL telnet CLI history-recall buffer overflow attempt (CVE-2026-57165)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>dos,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — 2 independent sources (NVD, OSV) confirm the fix).

1. Immediate mitigations

   • Disable the PJLIB-UTIL telnet CLI front-end on any application that does not require it. The NVD description confirms applications without the telnet CLI front-end are not affected.
   • If the CLI must run, restrict access via network controls (firewall rules, ACLs) so the telnet port is reachable only from trusted management networks — the CLI is unauthenticated, so network isolation is the primary compensating control.
   • Monitor for repeated history-navigation keystrokes and abnormal CLI session churn indicating crash attempts.

2. Patch / upgrade steps

   • Upgrade PJSIP past commit 628b716, which contains the fix for the stack buffer overflow in handle_up_down() (cli_telnet.c).
   • Track the upstream Teluu/PJSIP repository for tagged releases that include commit 628b716, and rebuild any embedded applications against the patched PJLIB-UTIL.
   • Verify the deployed binary includes the fix by confirming source at the patched commit.

3. Long-term hardening

   • Compile with stack-protection and hardening flags (-fstack-protector-strong, -D_FORTIFY_SOURCE=2, ASLR) to mitigate similar buffer overflows.
   • Remove or replace the unauthenticated telnet CLI with an authenticated, transport-encrypted, bound-to-localhost management interface.
   • Apply bounds-checking discipline for TUI redraw buffers and add fuzz testing for CLI input paths (cli_telnet.c).
   • Maintain an SBOM and version inventory to rapidly identify embedded PJSIP versions in VoIP/UC products.

References

• NVD — CVE-2026-57165: https://nvd.nist.gov/vuln/detail/CVE-2026-57165
• OSV — package advisory for CVE-2026-57165 (confirms fix presence)
• Teluu PJSIP project repository — commit 628b716 (upstream fix)
• MITRE CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
• CISA KEV Catalog — not listed (no evidence of exploitation in the wild)

Threat actor / exploit-in-the-wild evidence: None. No public PoC, no Nuclei template, no exploit code, and CISA KEV does not list this CVE. EPSS 0.00357 (29.0th percentile) indicates low predicted exploitation activity.