Critical severity · published Oct 6, 2022
CVE-2022-39244
Buffer overflow in pjlib scanner and pjmedia
9.8
CVSS
1.5%
EPSS
No
On KEV
Description
PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This issue has been patched and is available as commit c4d3498 in the master branch and will be included in releases 2.13 and later. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PJ
pjproject · pjsip
< 2.13 · source: vendor
PJ
Pjsip · Pjsip
before 2.13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39244
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39244
Patch
https://github.com/pjsip/pjproject/commit/c4d34984ec92b3d5252a7d5cddd85a1d3a8001ae
Third Party Advisory
https://github.com/pjsip/pjproject/security/advisories/GHSA-fq45-m3f7-3mhj
lists.debian.org
https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html
lists.debian.org
https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
Third Party Advisory
https://security.gentoo.org/glsa/202210-37
www.debian.org
https://www.debian.org/security/2023/dsa-5358
More from pjproject
9.8
CVE-2026-40892
PJSIP: Stack buffer overflow in pjsip_auth_create_digest2()
9.8
CVE-2026-32945
PJSIP is vulnerable to Heap-based Buffer Overflow through DNS parser
9.8
CVE-2026-25994
PJSIP has a heap buffer overflow in ICE with long username
9.1
CVE-2026-57163
PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend
9.1
CVE-2026-57162
PJSIP: Stack overflow parsing SDP a=crypto attributes