A heap buffer overflow vulnerability has been disclosed in PJPROJECT version 2.16, affecting the PJNATH ICE session component of the PJSIP library. The flaw carries CVE-2026-25994.
The bug lives in pj_ice_sess_create_check_list(). The vulnerable code allocates a 128-byte stack buffer for a username string, then copies a remote ICE ufrag into it using pj_strcpy() without any length check. When an attacker sends an SDP with an ice-ufrag attribute longer than roughly 130 bytes, the stack gets overflowed — overwriting the return address, stack frame, and canary.
The fix, introduced in commit 063b3a1 (version 2.17), adds a size check before the copy: if rem_ufrag->slen >= MAX_USERNAME_LEN, it returns PJ_ETOOBIG. Simple, effective.
The proof-of-concept targets PJSIP via SIP INVITE with a maliciously crafted SDP containing a 520-byte ufrag. It reliably triggers a segmentation fault in pjsua with ICE enabled. Tested on Kali, Ubuntu, and Debian.
If you’re running PJSIP 2.16 or earlier with ICE enabled, update to 2.17 immediately. The remote ufrag comes directly from a received SDP, making this reachable by unauthenticated attackers on the network.
