CVE-2026-32942CWE-416

PJSIP has ICE session use-after-free race conditions

High · published March 20, 2026

CVSS v4.0
8.0
EPSS
1%
Percentile
49.1
In the wild
Unconfirmed
What it is

PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below contain a heap use-after-free vulnerability in the ICE session that occurs when there are race conditions between session destruction and the callbacks. This issue has been fixed in version 2.17.

The record
Technical detail
CVSS v4.0
8.0 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
EPSS
0.00621 · 49.1th percentile
Weakness
CWE-416 · Use After Free
Published
2026-03-20T03:43Z
EPSS history
Timeline
  • 20 MAR 03:43Z
    PJSIP has ICE session use-after-free race conditions
    cvelistv5