CVE-2026-25994: PJSIP PJNATH ICE heap buffer overflow via long username
A buffer overflow in the PJNATH ICE session of PJSIP's PJProject is triggered when credentials contain an excessively long username, according to the CVE description. The record lists versions up to and including 2.16 as affected, and the CWE is CWE-120. No confirmed exploitation appears in the sources consulted, and the record shows no KEV listing.
Overview
PJSIP is an open source multimedia communication library written in C. According to the CVE record, versions 2.16 and earlier contain a buffer overflow in the PJNATH ICE session when it processes credentials with excessively long usernames. The weakness is classified as CWE-120 (Classic Buffer Overflow). The record was published on 2026-02-11.
Impact
The record scores the issue as critical, with a CVSS 3.1 base score of 9.8 from NVD and a vector indicating network attack, no privileges and no user interaction, with high confidentiality, integrity and availability impact. A GitHub CNA score of 8.1 under CVSS 4.0 is also listed. Heap overflows of this type can, in general, lead to crashes or memory corruption; the sources do not confirm the specific outcome for this flaw.
Affected products and versions
- Pjsip Pjproject: version 2.16 and earlier, as stated in the record.
- Pjsip Pjsip: 2.16 and earlier, as stated in the record.
The record does not list a fixed version number. Fix commits and a GitHub Security Advisory are linked as patch references, so the remediation path should be checked against those sources.
Exploitation status
The record does not list this CVE in CISA KEV. No confirmed exploitation appears in the sources consulted. The SSVC fields show exploitation as none and automatable as yes, and the EPSS probability is 0.02254 (percentile 0.82812). These are estimates, not evidence of active attacks.
Remediation and mitigation
- Review the patch commit and the GitHub Security Advisory linked in the record and apply the vendor fix to PJProject builds at 2.16 or earlier.
- Identify every application or device that embeds PJSIP/PJProject, including vendor-supplied firmware, since bundled copies may not be updated automatically.
- Where patching is delayed, restrict exposure of SIP and ICE-related services to trusted networks, as a general defensive measure.
Detection guidance
- Inventory PJSIP/PJProject versions across servers, endpoints and embedded systems.
- Monitor for abnormal crashes or restarts of processes that use PJNATH or ICE functionality, which may indicate memory corruption attempts.
- Review logs of authentication and session setup for unusually long username fields.
Limitations of the available information
The sources consulted do not provide a detailed technical analysis of the code path, the exact fixed version string, or proof-of-concept details, and this analysis does not include them. The CVSS 3.1 and 4.0 scores are reported by different providers and their rationale is not included in the record. Whether the flaw is reachable in a given deployment depends on configuration, which the record does not describe.
Frequently asked questions
Is CVE-2026-25994 being actively exploited?
The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Which versions are affected?
The record lists PJProject version 2.16 and earlier as affected.
Is there a fix?
The record links patch commits and a GitHub Security Advisory, but does not state a fixed version number. Check those sources.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.