PJSIP is a modestly represented open-source SIP (Session Initiation Protocol) library and SDK that, despite a narrow product portfolio, achieves prominence through widespread embedding in VoIP applications, softphones, and real-time communications platforms. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and frequently acquire public exploit code, concentrating in memory-safety weakness classes including heap-based and stack-based buffer overflows, out-of-bounds reads, and use-after-free conditions that are endemic to C-based protocol parsing. Defenders should inventory downstream products that bundle PJSIP and prioritize patches for this library tier; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Pjsip over time
Signals from CVEs in this vendor scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-25994CRITICAL PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a buffer overflow vulnerability exists in PJNATH ICE Session when processing cre | Feb 11, 2026 | 9.8 | 44 | NO | YES |
CVE-2026-32945CRITICAL PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a Heap-based Buffer Overflowvulnerability in the DNS parser's name lengt | Mar 20, 2026 | 9.8 | 32 | NO | NO |
CVE-2022-39244CRITICAL PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are | Oct 6, 2022 | 9.8 | 32 | NO | NO |
CVE-2026-40892CRITICAL PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsip_auth_create_digest2() in PJSIP when usin | Apr 21, 2026 | 9.8 | 31 | NO | NO |
CVE-2022-24786CRITICAL PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection I | Apr 6, 2022 | 9.8 | 31 | NO | NO |
CVE-2022-23547CRITICAL PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. This issue | Dec 23, 2022 | 9.8 | 29 | NO | NO |
CVE-2026-40614HIGH PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is a buffer overflow when decoding Opus audio frames due to insufficient b | Apr 21, 2026 | 8.8 | 27 | NO | NO |
CVE-2026-32942HIGH PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below contain a heap use-after-free vulnerability in the ICE session that occurs w | Mar 20, 2026 | 8.1 | 27 | NO | NO |
CVE-2015-2003CRITICAL The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly | Mar 29, 2018 | 9.8 | 27 | NO | NO |
CVE-2026-33069HIGH PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a cascading out-of-bounds heap read in pjsip_multipart_parse(). After bo | Mar 20, 2026 | 7.5 | 26 | NO | NO |
Signals from CVEs in this vendor scope (15 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Pjsip.
Media articles that mention a CVE ID that affects a product developed by Pjsip — matched by CVE ID, not by vendor name.