CVE-2021-43302 Information disclosure in pjsip

Critical 9.1 Published 16 Feb 2022 Updated 4 Nov 2025

An attacker can trigger an out-of-bounds read in the PJSIP library via a short filename argument, potentially disclosing sensitive memory contents.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-43302?

CVE-2021-43302 is a critical vulnerability in Debian Debian Linux, published on 16 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Read out-of-bounds in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause an out-of-bounds read when the filename is shorter than 4 characters.

Weakness: CWE-125

Which versions are affected by CVE-2021-43302?

It affects 2 products.

Products include Debian Debian Linux, Teluu Pjsip.

How do I fix CVE-2021-43302?

Upgrade to a fixed version.

Is CVE-2021-43302 being exploited?

There is no known exploitation of CVE-2021-43302 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2021-43302, DEBIAN-CVE-2021-43302, GHSA-qq7v-ccww-8wh3, UBUNTU-CVE-2021-43302.