CVE-2022-24764CWE-120CWE-121

Stack buffer overflow in pjproject

High · published March 22, 2022

CVSS v3.1
7.5
EPSS
2%
Percentile
83.7
In the wild
Unconfirmed
What it is

PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02376 · 83.7th percentile
Weaknesses
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'); CWE-121 · Stack-based Buffer Overflow
Published
2022-03-22T00:00Z
EPSS history
Timeline
  • 22 MAR 00:00Z
    Stack buffer overflow in pjproject
    cvelistv5