CVE-2022-24786

Potential out-of-bound read/write in PJSIP

State: Published
Severity: 9.8 Critical
Published: Apr 6, 2022
Updated: Apr 23, 2025
Reserved: Feb 10, 2022

Description

PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-125 Out-of-bounds Read
CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
pjprojectpjsip	<= 2.12Affected

References

https://github.com/pjsip/pjproject/security/advisories/GHSA-vhxv-phmx-g52q
https://github.com/pjsip/pjproject/commit/11559e49e65bdf00922ad5ae28913ec6a198d508
GLSA-202210-37vendor-advisory
[debian-lts-announce] 20221117 [SECURITY] [DLA 3194-1] asterisk security updatemailing-list
DSA-5285vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.