CVE-2026-25994: 
NixOS vulnerability analysis and mitigation

CVE-2026-25994 is a heap buffer overflow vulnerability in PJSIP's PJNATH ICE Session component, triggered when processing credentials with excessively long usernames. It affects PJSIP versions 2.16 and earlier, with the patched version being 2.17. The vulnerability was published on February 11, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat Advisory, GitHub Advisory).

The root cause is a classic buffer overflow (CWE-120) in pjnath/src/pjnath/ice_session.c, specifically in the pj_ice_sess_create_check_list() function. Prior to the fix, a fixed-size stack buffer of only 128 bytes was allocated for constructing the combined ICE username (local ufrag + ":" + remote ufrag), with no bounds checking on the input lengths. An attacker can supply an excessively long remote username fragment (ufrag) during ICE credential exchange, causing the buffer to overflow into adjacent heap memory. The patch increases the buffer to 512 bytes (MAX_USERNAME_LEN) and adds explicit length validation — rejecting credentials where the combined username would exceed this limit or where ufrag/passwd are below minimum required lengths (GitHub Commit, GitHub Advisory).

Successful exploitation can range from unexpected application termination (denial of service) to control flow hijacking and arbitrary code execution via memory corruption. Because the attack requires no authentication, no user interaction, and can be performed remotely over the network, the full confidentiality, integrity, and availability of the affected system are at risk. Any application embedding PJSIP and using ICE (Interactive Connectivity Establishment) for NAT traversal — including VoIP clients, WebRTC implementations, and SIP stacks — is potentially affected (GitHub Advisory, Red Hat Advisory).

As of initial disclosure, no public proof-of-concept exploit was available and no in-the-wild exploitation had been reported (Red Hat Advisory). However, a PoC repository appeared on GitHub (github.com/VABISMO/cve-2026-25994_PJSIP) and an entry was published on Exploit-DB (exploit ID 52561) and Sploitus in subsequent months, indicating weaponization activity. The EPSS score is approximately 0.042% (low probability of near-term exploitation), and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. No specific threat actor attribution has been reported.

1. Reconnaissance: Identify targets running PJSIP 2.16 or earlier that expose ICE-based communication endpoints (e.g., SIP/VoIP services, WebRTC gateways) using network scanning tools such as Shodan or SIPVicious.
2. Initiate ICE session: Establish or intercept an ICE session negotiation with the target application, which involves exchanging SDP (Session Description Protocol) offers/answers containing ICE credentials (ufrag and password).
3. Craft malicious credentials: Construct an ICE credential set where the remote ufrag value exceeds 128 bytes (the original buffer size), or where the combined local ufrag + ":" + remote ufrag exceeds 128 bytes, to trigger the overflow in pj_ice_sess_create_check_list().
4. Trigger the overflow: Send the crafted SDP or STUN binding request containing the oversized ufrag to the target. The vulnerable code copies the combined username into the fixed 128-byte buffer without bounds checking, overwriting adjacent heap memory.
5. Achieve code execution or crash: Depending on heap layout and memory protections, the overflow may corrupt heap metadata or function pointers, potentially enabling arbitrary code execution, or at minimum causing a denial-of-service crash of the PJSIP-based application (GitHub Commit, GitHub Advisory).

• Network: Unexpected or malformed SDP messages containing ICE ufrag values exceeding 128 bytes; STUN binding requests with abnormally long username attributes directed at SIP/VoIP services.
• Logs: Application crash logs or core dumps originating from the PJSIP process, particularly stack traces referencing pj_ice_sess_create_check_list() or ice_session.c; repeated connection attempts from a single source with varying oversized ufrag values.
• Process: Abnormal termination (segfault/SIGABRT) of PJSIP-based processes; unexpected child processes spawned by the SIP/VoIP application following ICE negotiation.
• File System: Presence of core dump files in the application working directory following crashes; unexpected files written by the application process after ICE session handling.

Upgrade PJSIP to version 2.17 or later, which includes the fix in commit 063b3a1 that increases the username buffer to 512 bytes and adds explicit credential length validation (GitHub Commit, GitHub Advisory). Ubuntu users should apply the patch provided in security notice USN-8122-1. As a temporary workaround where patching is not immediately possible, restrict network access to ICE/SIP endpoints using firewall rules to limit exposure to trusted peers only. Red Hat users should monitor the Red Hat Bugzilla entry (Bug 2439180) for distribution-specific package updates (Red Hat Bugzilla).

Red Hat tracked the vulnerability via Bugzilla (Bug 2439180) and published a CVE advisory shortly after disclosure on February 11, 2026 (Red Hat Advisory). Ubuntu issued security notice USN-8122-1 addressing the issue alongside other PJSIP vulnerabilities. Security aggregators including Tenable (Nessus plugins 299024 and 303754), Qualys (detection ID 6032636), and VulDB covered the vulnerability. The infinitsec.net blog published a technical write-up titled "PJSIP has a heap buffer overflow in ICE with long username," and the vulnerability received coverage in German Linux security media (pro-linux.de).