CVE-2026-40892 Details
Description
PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsip_auth_create_digest2() in PJSIP when using pre-computed digest credentials (PJSIP_CRED_DATA_DIGEST). The function copies credential data using cred_info->data.slen as the length without an upper-bound check, which can overflow the fixed-size ha1 stack buffer (128 bytes) if data.slen exceeds the expected digest string length.
A stack buffer overflow vulnerability has been identified in PJSIP versions through 2.16, specifically within the `pjsip_auth_create_digest2()` function. This issue arises when pre-computed digest credentials are used, as the function improperly copies credential data without a sufficient upper-bound check. The lack of validation allows data lengths to exceed the fixed-size stack buffer, leading to an overflow. Applications that utilize the `PJSIP_CRED_DATA_DIGEST` credential type and pass manipulated data through `cred_info->data` are vulnerable.
Users can upgrade to PJSIP version 2.17, where this vulnerability has been patched. The patch is available in the master branch of the PJSIP GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pjsip/pjproject/commit/c82123ea6f3c3652bbc9ebd5e9e658c301451687 | [email protected] | Patch |
| https://github.com/pjsip/pjproject/security/advisories/GHSA-2wcg-w3c4-48r7 | [email protected] | MitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pjsip pjsip | < 2.17 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | Initial Analysis | [email protected] |
| Apr 21, 2026 | New CVE Received | [email protected] |