CVE-2026-40892

CVE-2026-40892 is a stack buffer overflow vulnerability in PJSIP version 2.16 and earlier, specifically in the pjsip_auth_create_digest2() function when processing pre-computed digest credentials. The flaw occurs because the function fails to validate the length of credential data before copying it into a fixed 128-byte stack buffer, allowing attackers to overflow the ha1 buffer if the credential data exceeds expected digest string lengths. The vulnerability carries a moderate risk profile with a FAUCET risk score of 40.0/100. While the specific CVSS vector is not available, stack buffer overflows typically present network-adjacent or local attack vectors with medium complexity, potentially enabling arbitrary code execution or denial of service depending on exploitation context and the affected application's privileges. Currently, CVE-2026-40892 is not listed as actively exploited in the Known Exploited Vulnerabilities (KEV) database, though it is flagged as Active on security tracking lists. The EPSS score of 0.0004 indicates this vulnerability has received relatively low community attention compared to the broader CVE population, suggesting either limited public exploit availability or constrained practical exploitability in real-world environments.