CVE-2026-32945 PJSIP is vulnerable to Heap-based Buffer Overflow through DNS parser
Heap-based buffer overflow in PJSIP's DNS parser allows attackers to execute code or cause denial of service in applications using the built-in resolver.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32945?
CVE-2026-32945 is a high-severity memory corruption vulnerability in pjsip pjproject, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a Heap-based Buffer Overflowvulnerability in the DNS parser's name length handler. Thisimpacts applications using PJSIP's built-in DNS resolver, such as those configured with pjsua_config.nameserver or UaConfig.nameserver in PJSUA/PJSUA2. It does not affect users who rely on the OS resolver (e.g., getaddrinfo()) by not configuring a nameserver, or those using an external resolver via pjsip_resolver_set_ext_resolver(). This issue is fixed in version 2.17. For users unable to upgrade, a workaround is to disable DNS resolution in the PJSIP config (by setting nameserver_count to zero) or to use an external resolver implementation instead.
Weakness: CWE-122
Which versions are affected by CVE-2026-32945?
It affects 1 product.
Products include Pjsip Pjsip.
How do I fix CVE-2026-32945?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-32945 being exploited?
There is no known exploitation of CVE-2026-32945 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in pjsip pjproject
- CVE-2026-28799 PJSIP: Heap use-after-free in PJSIP presence subscription termination handler
- CVE-2026-29068 PJSIP: Stack buffer overflow in Opus codec parser
- CVE-2026-40614 PJSIP: Heap buffer overflow in Opus codec decoding
- CVE-2026-40892 PJSIP: Stack buffer overflow in pjsip_auth_create_digest2()
- CVE-2026-26967 PJSIP has a Heap-based Buffer Overflow vulnerability in its H.264 unpacketizer
Sources
Also known as ALPINE-CVE-2026-32945, DEBIAN-CVE-2026-32945, GHSA-jr2p-p2w4-rr9q, UBUNTU-CVE-2026-32945.