---
cve: "CVE-2026-57160"
severity: "LOW"
cvss: 3.1
epss: "6%"
vendor: "Generic Security"
kev: false
exploited: false
published: "2026-09-04 18:17:53"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-07T00:31:09+02:00"
---

# CVE-2026-57160

> 3.1 LOW

## Beschreibung

PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c, the function that serializes generic array headers (such as Allow, Require, Supported, and Unsupported). Under certain output-buffer boundary conditions the function can write one byte past the end of the buffer. This is reachable mainly in applications that parse and re-serialize incoming SIP requests — for example a proxy, SBC, or B2BUA — where a remote peer can influence the serialized message. The out-of-bounds write is a single fixed byte; code execution and information disclosure are not demonstrated, and in typical pool-based allocations the byte falls within allocation slack. This issue has been patched via commit d6a0e7f.

## Patch verfügbar (OSV)

- d6a0e7f76611c3a6f530ee051e3e7a622bb1748c (Commit)

## Referenzen

- <https://github.com/pjsip/pjproject/commit/d6a0e7f76611c3a6f530ee051e3e7a622bb1748c>
- <https://github.com/pjsip/pjproject/security/advisories/GHSA-277r-3q2j-mxcw>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-57160) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_