CVE-2026-25994

Katalog CVE

CVSS 9.8 · Critical EPSS 2,3%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada pjsip. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a buffer overflow vulnerability exists in PJNATH ICE Session when processing credentials with excessively long usernames.

Rincian

Terbit di NVD

11 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pjsip/pjproject/security/advisories/GHSA-j29p-pvh2-pvqp patch · advisory vendor
• https://github.com/pjsip/pjproject/commit/063b3a155f163cc5a9a1df2c56b6720fd3a0dbb0 patch