CVE-2026-25994 – PJSIP PJNATH ICE Session Buffer Overflow
CVE ID: CVE-2026-25994
Severity: High
CVSS Score: 8.1
Impact: Remote Code Execution (RCE) or Denial of Service
Exploitability: Remote network attacker
Patch/Upgrade link:
https://github.com/pjsip/pjproject/security/advisories/GHSA-j29p-pvh2-pvqp
Overview
CVE-2026-25994 affects the PJNATH component of the PJSIP open-source SIP/VoIP stack. PJSIP’s PJNATH module handles ICE (Interactive Connectivity Establishment) and NAT traversal traffic. The vulnerability arises from insufficient validation of credential input lengths. A network peer can send a deeply oversized username or credential field during an ICE or SIP exchange. Because the vulnerable code fails to limit the size of this input, it copies more bytes into memory than the buffer is designed to hold. This corrupts heap memory and can lead to one of two outcomes:
- Denial of Service — the application crashes due to corrupted memory.
- Remote Code Execution — with precise manipulation and favorable memory layout, the corrupted heap can be abused to execute arbitrary instructions.
Attackers do not need authentication or prior access to exploit this condition. The flaw is reachable over the network from any host that can interact with a SIP/ICE endpoint built using the vulnerable library version.
Impact
This weakness undermines the core assumptions that protocol parsers should enforce strict limits on input size. When a single field length is not bounded, heap structures can be overwritten, creating a vector for control of program flow. On affected hosts, this could allow:
- Full compromise of the SIP/VoIP application process
- Execution of arbitrary code as the service user
- Persistence or lateral movement into adjacent services if post-exploit actions occur
- Large-scale crashes during SIP negotiations causing outages
How Exploitation Works
During normal SIP/ICE negotiation, endpoints exchange credential information to authenticate and establish media paths. The PJNATH code allocates a fixed-length buffer for credentials. An attacker crafts a network message that includes:
- An ICE or SIP credential
- A username string that exceeds expected limits
When the vulnerable routine copies this field without validating its size, it overwrites adjacent memory. That heap corruption disrupts normal heap management metadata. Based on how the application and runtime libraries manage that heap, this can trigger a crash or redirect program execution.
This is not a flaw in cryptography or protocol design — it’s a memory safety issue caused by unchecked input.
Detection and Logging
Detecting attempts to exploit this flaw requires attention to protocol fields, process behavior, and network anomalies.
Log Sources to Collect
Collect data from:
- SIP server logs (authentication, parsing, error events)
- ICE component logs from the PJNATH library
- System logs and process crash reports
- Network IDS/IPS captures focused on SIP/ICE protocols
- Flow logs (NetFlow/sFlow) that record unusual volume or failed negotiations
- Application output that indicates parsing exceptions or buffer size warnings
Logging is most useful when it captures the actual contents or length metrics of critical fields.
Indicators of Exploitation Attempts
You should treat these patterns as suspicious:
- Repeated buffer overflow or parsing error messages in SDP/SIP logs
- SIP or ICE negotiation messages with unusually large username or credential fields
- Sudden crashes of the SIP service or ICE components without native justification
- IDS alerts tied to long strings in SIP headers during authentication
- Unexpected memory corruption or heap error reports in system logs
Detection Rules
Below are examples of detection rules that help reveal malformed input used in exploitation attempts. Adjust thresholds based on typical credential lengths in your environment.
Network IDS / Snort / Suricata Rule
alert udp any any -> any 5060 (
msg:"SIP credential overflow attempt - large username";
flow:established,to_server;
content:"Authorization:"; nocase;
pcre:"/username=\".{80,}\"/U";
sid:2609401; rev:1;
)
Explanation:
This rule notifies when a SIP Authorization header contains a username field longer than 80 characters. Credentials in real environments are usually much shorter; significant deviation suggests probing.
Zeek Scripting (Policy Indicator)
event sip_message(c: connection, msg: string)
{
local username = extract_username(msg);
if ( |username| > 80 ) {
NOTICE([$note=Info::SIP_Anomaly,
$msg=fmt("Suspicious SIP credential field length: %d", |username|),
$conn=c ]);
}
}
Explanation:
Generate a notice when a SIP message’s credential username exceeds normal length. Customize 80 to suit your deployment.
Syslog / SIEM Rule
index="sip_logs"
| where field_len(username) > 80
| stats count by src_ip, username
| sort -count
Explanation:
Flag any source IP that sends authentication attempts with unusually long usernames, then aggregate the counts. High frequency may indicate scanning.
Exploit Availability
As of this briefing, there is no known public exploit or proof-of-concept code that reliably triggers this vulnerability. Security communities have acknowledged its existence, but active exploitation in the wild remains unconfirmed. That does not lessen the risk; absence of public exploit code is not evidence that exploits don’t exist. Monitoring for newly released exploit code should be part of ongoing threat intelligence.
Mitigation
The only correct way to address this vulnerability is to update to the patched version of PJNATH / pjproject that includes the fix. The patch enforces proper length checks and eliminates the unsafe buffer copy logic that leads to heap corruption.
Official patch/upgrade link:
➡️ https://github.com/pjsip/pjproject/security/advisories/GHSA-j29p-pvh2-pvqp
Apply this update on all builds and distributions that incorporate the vulnerable code. Test in staging before production deployment. After patching, immediately review detection logs for historical triggers to identify attempted exploitation prior to mitigation.
Summary of Detection Strategy
When defending against this class of flaw:
- Monitor SIP/ICE input for suspicious field sizes
- Capture and analyze parsing exceptions
- Treat frequent negotiation failures as potential probes
- Use IDS rules that highlight long credential strings
- Correlate process crashes with incoming SIP traffic
- Maintain updated patch status on all SIP infrastructure
Final Takeaway
This vulnerability is serious because it combines a network-reachable parser with unsafe memory handling. Detecting exploitation relies on both content inspection and behavioral indicators such as crashes. Patch quickly and monitor aggressively.
