Pjsip: Heap out-of-bounds read in DNS parser (CVE-2026-32945)

CVE-2026-32945 is a heap-based out-of-bounds (OOB) read vulnerability affecting Pjsip (pjproject) versions 2.16 and earlier. The flaw resides in the DNS compression pointer parsing logic within get_name_len() and get_name() in dns.c. An attacker can trigger a crash in any application utilizing this library (including Asterisk and FreeSWITCH) by responding to a DNS query with a crafted 20-byte packet where the compression pointer marker (0xC0) is the final byte, causing an out-of-bounds memory read.

Impact

The vulnerability results in a remote denial-of-service (DoS) condition, crashing the Pjsip-based application. No remote code execution has been documented, but public proof-of-concept code is available to trigger the crash.

Recommendation

• Upgrade all deployments utilizing the Pjsip library to version 2.17 or later immediately.
• Patching requires an update to the core library; ensure applications linked against libpjproject are recompiled or updated with the fixed library version (commit 5311aee).
• Review network configurations for VOIP infrastructure; ensure DNS resolution is restricted to trusted, internal, or hardened recursive resolvers to mitigate the risk of rogue DNS response delivery.