CVE-2026-41415: PJSIP SIP Multipart Content-ID URI Out-of-Bounds Read
A malformed Content-ID URI in a SIP multipart message body can trigger an out-of-bounds read in PJSIP, according to the record. The description states that versions 2.16 and earlier are affected and that the issue is fixed in 2.17. The record rates it critical with an NVD score of 9.1, and no confirmed exploitation appears in the sources consulted.
Overview
PJSIP is a multimedia communication library written in C. According to the record, versions 2.16 and earlier contain an out-of-bounds read that occurs while parsing a malformed Content-ID URI inside a SIP multipart message body. Insufficient length validation allows reads beyond the intended buffer. The fix is available in 2.17. The vendor advisory is at GitHub security advisory GHSA-935m-fmf5-j4pm, and the fix commit is listed at commit 4225a93.
Impact
The weakness is classified as CWE-125, Out-of-bounds Read. NVD assigns a base score of 9.1 (critical), and the record describes the attack as network-reachable, requiring no privileges and no user interaction, with high confidentiality and availability impact and no integrity impact. The GitHub CNA assigns a score of 6.7. Because the flaw is a read and not a write, the most direct consequences described are information exposure and process instability, which is an inference from the weakness type rather than a statement from the sources.
Affected products and versions
- Pjsip Pjproject: versions before 2.17, as listed in the record.
- Teluu Pjsip: versions before 2.17, as listed in the record.
- The description states that versions 2.16 and earlier are affected.
The record does not list every intermediate release or confirm the first vulnerable version, so administrators should verify their exact build against the vendor advisory.
Exploitation status
The CISA Known Exploited Vulnerabilities catalog does not list this CVE, so active exploitation is not confirmed by that source. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00539 (percentile 0.44571), and the SSVC record marks exploitation as none while marking the issue as automatable.
Remediation and mitigation
- Upgrade PJSIP to version 2.17 or later, which the record identifies as the fixed version.
- Review the vendor advisory and the fix commit to confirm the change applies to your build.
- Inventory every application that embeds PJSIP, including products that bundle it statically, because those builds may not appear in package manager listings.
- Where patching is delayed, restrict which network sources can reach SIP signaling interfaces, since the record describes the attack as network-based.
Detection guidance
- Identify systems running PJSIP and record their exact library version.
- Monitor SIP signaling for unusually malformed multipart bodies or abnormal Content-ID headers, and review related crash or restart events in SIP services.
- Treat unexplained crashes or memory-related faults in PJSIP-based services as potential indicators and correlate them with inbound SIP traffic logs.
Limitations of the available information
The record does not provide a detailed technical description of the vulnerable code path, a proof of concept, or details about the length validation logic. The record's title refers to a length underflow, while the description and CWE identify an out-of-bounds read; this analysis follows the description and CWE. Exploitability conditions beyond the CVSS vector are unknown, and no vendor-supplied statement about real-world impact was found in the sources consulted.
Frequently asked questions
Which PJSIP versions are affected by CVE-2026-41415?
According to the record, versions 2.16 and earlier are affected, and the affected product entries list versions before 2.17.
What version fixes this issue?
The record states that the vulnerability is fixed in 2.17, and the fix commit is referenced in the GitHub advisory.
Is this vulnerability known to be exploited?
The CISA KEV catalog does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.