CVE-2026-57165
Received Received - Intake

Stack Buffer Overflow in PJSIP Telnet CLI

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: GitHub, Inc.

Description
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 628b716, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when redrawing the command line during history recall (handle_up_down() in cli_telnet.c). This affects only applications that enable the telnet CLI front-end (same gating as the related CLI issue). The line-redraw sequence for a recalled history entry can accumulate more data than a fixed-size stack buffer holds, which may lead to application termination. Exploitation requires access to the unauthenticated telnet CLI, which already permits arbitrary CLI commands, so the additional impact is limited. Applications that do not enable the telnet CLI front-end are not affected. This issue has been patched via commit 628b716.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-57165
EUVD
EUVD-2026-71659

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pjsip pjsip to 628b716 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack buffer overflow in PJSIP's telnet CLI front-end. It occurs when redrawing a command line during history recall, causing more data to be written to a fixed-size stack buffer than it can hold. This may lead to application termination. Exploitation requires access to the unauthenticated telnet CLI, which already allows arbitrary commands.

Detection Guidance

To detect this vulnerability, check if your PJSIP application has the telnet CLI front-end enabled. This can be done by inspecting configuration files or startup logs for telnet-related settings. If enabled, verify the version of PJSIP in use and confirm it is prior to commit 628b716.

Impact Analysis

The impact is limited because exploitation requires access to the unauthenticated telnet CLI. Since the CLI already permits arbitrary commands, the additional risk from this overflow is minimal. Only applications enabling the telnet CLI front-end are affected.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA. The issue is limited to applications using the unauthenticated telnet CLI front-end, which already allows arbitrary command execution. Since exploitation requires access to this front-end, the additional risk is minimal and does not affect data protection or privacy controls.

Mitigation Strategies

Immediately disable the telnet CLI front-end in your PJSIP application if enabled. Update PJSIP to the patched version (commit 628b716 or later). If telnet access is required, restrict network access to the telnet port and use authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57165. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart