CVE-2026-29068

High

Published: 06 March 2026

Published

06 March 2026

Modified

10 March 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0006 19.0th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-29068 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Pjsip Pjsip. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.

Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Remote network exploitation of PJSIP (public-facing VoIP/multimedia apps) via crafted RTP payload triggers stack overflow crash, directly enabling T1190 initial access vector and T1499.004 application DoS via vulnerability exploitation.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, there is a stack buffer overflow vulnerability when pjmedia-codec parses an RTP payload contain more frames than the caller-provided frames can hold. This…

issue has been patched in version 2.17.

Deeper analysisAI

CVE-2026-29068 is a stack buffer overflow vulnerability (CWE-121) in PJSIP, a free and open-source multimedia communication library written in C. The flaw affects the pjmedia-codec component in versions prior to 2.17, where parsing an RTP payload containing more frames than the caller-provided buffer can hold triggers the overflow.

With a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the vulnerability is exploitable over the network with low complexity, requiring no privileges or user interaction. Remote attackers can send a specially crafted RTP payload to any system processing it via PJSIP, causing a stack buffer overflow that leads to denial of service through application crashes or instability.

The issue has been patched in PJSIP version 2.17. Security practitioners should upgrade to this version for mitigation. Additional details are available in the GitHub security advisory at https://github.com/pjsip/pjproject/security/advisories/GHSA-pqww-jrxr-457f and the patching commit at https://github.com/pjsip/pjproject/commit/6c9024511bf5307ff72efde1f90c9a2a226d8967.