CVE-2026-25994: PJSIP PJNATH ICE Session Buffer Overflow via Long ICE Usernames

CVE-2026-25994 is a buffer overflow (CWE-120) in the PJNATH ICE session code of PJSIP, the open-source SIP and multimedia communication library that device vendors embed in VoIP phones, SIP-ALG routers, intercoms and other firmware that negotiates WebRTC/ICE connectivity: PJSIP 2.16 and earlier copies the combined remote and local ICE username fragments into a fixed 128-byte stack buffer without validating their combined length, so a peer offering an oversized username in the ICE candidate exchange can overflow that buffer; NVD's own analysis rates this CVSS v3.1 9.8 (critical).

CVE-2026-25994 affects PJNATH, the ICE/STUN/TURN component of PJSIP — the open-source SIP and multimedia communication library (C, with C++/Java/C#/Python bindings) that many VoIP phones, SIP gateways, PBX appliances and video-intercom firmware images embed directly rather than linking as a distribution package. NVD's description states: "PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a buffer overflow vulnerability exists in PJNATH ICE Session when processing credentials with excessively long usernames" (NVD).

NVD's own Primary analysis scores this CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, with high impact to confidentiality, integrity and availability (NVD). PJSIP's own GitHub Security Advisory GHSA-j29p-pvh2-pvqp, referenced by NVD as the vendor advisory, rates the issue CVSS v4.0 8.1 (high) under the same CWE-120 classification (NVD).

The fix commit shows the underlying bug directly: pj_ice_sess_create_check_list() in pjnath/src/pjnath/ice_session.c copied the combined remote and local username fragments into char buf[128], a fixed-size stack buffer, with no check that the combined, colon-separated credential string actually fit. The patch enlarges the buffer to a 512-byte MAX_USERNAME_LEN constant and adds explicit length checks before the copy, rejecting a remote ufrag that is too short ("The ufrag must be at least 4 bytes, passwd at least 22 bytes") or a combined username that would exceed the new buffer ("Combined usernames must not exceed 512 bytes") (PJSIP fix commit 063b3a1).

The fix shipped in the PJSIP 2.17 release, published 2026-04-22, after the commit landed against the pjsip/pjproject repository on 2026-02-11 (PJSIP 2.17 release).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.02075 (81.555th percentile) as of 2026-11-06 (CISA KEV, FIRST EPSS).

Devices or firmware images that embed PJSIP/PJNATH for SIP, WebRTC or other ICE-based connectivity — VoIP endpoints, SIP gateways, video doorbells and intercoms are typical examples — should be rebuilt against PJSIP 2.17 or later, since this is a source-embedded library rather than a shared system package that can be patched independently of the firmware image.

• PJSIP 2.16 and earlier has a buffer overflow in PJNATH ICE Session when processing credentials with excessively long usernames. — NVD
• NVD's own Primary analysis scores this CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; PJSIP's GHSA-j29p-pvh2-pvqp rates it CVSS v4.0 8.1 (high). — NVD
• The fix commit enlarges the ICE session username buffer from a fixed char buf[128] to a 512-byte MAX_USERNAME_LEN and adds explicit length checks on the remote ufrag/passwd and combined username before copying into it. — PJSIP fix commit 063b3a1
• The fix shipped in the PJSIP 2.17 release, published 2026-04-22. — PJSIP 2.17 release
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.02075 (81.555th percentile) as of 2026-11-06. — FIRST EPSS