PJSIP (< 2.14.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pjsip--2.14.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 15 Oct 2026 16:23:03 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMultiple Vulnerabilities in PJSIPhttps://feed.craftedsignal.io/briefs/2026-10-pjsip-vulnerabilities/Thu, 15 Oct 2026 16:23:03 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-pjsip-vulnerabilities/PJSIP contains multiple vulnerabilities, including heap buffer and integer overflows in SIP message processing, which can be exploited by an unauthenticated remote attacker to cause a denial-of-service condition or potentially execute arbitrary code.PJSIP, a widely used open-source multimedia communication library, is vulnerable to multiple security flaws including heap buffer overflows and integer overflows (CVE-2024-51493, CVE-2024-51494, and CVE-2024-51495). These vulnerabilities stem from improper processing of incoming SIP messages. An unauthenticated remote attacker can exploit these flaws by sending specially crafted SIP packets to an application utilizing the affected PJSIP versions. Successful exploitation may result in unauthorized data manipulation, information disclosure, or a denial-of-service (DoS) state, where the affected service crashes or becomes unresponsive. Versions prior to 2.14.1 are confirmed to be vulnerable. Defenders should prioritize updating instances of PJSIP to version 2.14.1 or later to mitigate these risks.

Impact

Successful exploitation of these vulnerabilities allows an unauthenticated remote attacker to disrupt communication services via a denial-of-service, or potentially gain control over the affected application through memory corruption. PJSIP is integrated into numerous VoIP, unified communications, and softphone products, making this impact widespread across organizations relying on real-time communication infrastructure.

Recommendation

  • Patch all instances of PJSIP by upgrading to version 2.14.1 or later to address CVE-2024-51493, CVE-2024-51494, and CVE-2024-51495.
  • Audit network logs for anomalous SIP traffic or malformed packets directed toward VoIP infrastructure and softphone services.
  • Review vendor-specific advisories for any proprietary products that bundle PJSIP, as they may require product-specific patches beyond the library update.
]]>lowadvisory