CVE-2026-28799: 
NixOS vulnerability analysis and mitigation

CVE-2026-28799 is a heap use-after-free vulnerability in PJSIP's event subscription framework (evsub.c), triggered during presence unsubscription via a SUBSCRIBE request with Expires=0. It affects all PJSIP versions prior to 2.17, including applications acting as presence servers (UAS) handling SUBSCRIBE requests for presence, MWI, and dialog-event. The vulnerability was published on March 6, 2026, and patched in version 2.17. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a race condition in callback ordering within evsub.c (CWE-416: Use After Free; CWE-825: Expired Pointer Dereference). During Expires=0 unsubscription, on_tsx_state_uas() calls set_state(TERMINATED), which triggers pres_on_evsub_state() and frees status_pool/tmp_pool. Subsequently, on_rx_refresh fires and accesses the already-freed memory via pjsip_pres_notify(), causing the heap use-after-free. The fix defers the on_evsub_state(TERMINATED) callback until after on_rx_refresh completes, implemented centrally in evsub.c to cover all affected modules. The vulnerability was discovered via AddressSanitizer in the CI test suite, manifesting as a heap-use-after-free in memcpy from pjrpid_add_element (rpid.c:128) (GitHub Commit, GitHub Advisory).

Successful exploitation results in a denial of service by crashing the PJSIP-based application through heap memory corruption. Any application acting as a presence server (UAS) — including those supporting presence, MWI, and dialog-event — is affected. There is no confidentiality or integrity impact; the primary consequence is high availability impact, potentially disrupting VoIP and multimedia communication services relying on PJSIP (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit is currently known, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is remotely exploitable without authentication or user interaction, requiring only the ability to send a crafted SUBSCRIBE request with Expires=0 to a vulnerable PJSIP presence server. The EPSS score is approximately 0.042%, indicating a low (but non-zero) probability of exploitation in the near term. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible SIP servers or applications built on PJSIP versions prior to 2.17 that act as presence servers (UAS), using SIP scanning tools such as sipvicious or nmap with SIP scripts.
2. Craft malicious SUBSCRIBE request: Construct a SIP SUBSCRIBE request targeting the presence event package (Event: presence) with Expires: 0, which signals an unsubscription.
3. Send the request: Transmit the crafted SUBSCRIBE request to the target server. No authentication is required; the request can be sent from any network-accessible host.
4. Trigger use-after-free: The server's on_tsx_state_uas() handler processes the Expires=0 request, calls set_state(TERMINATED), which frees status_pool/tmp_pool. The subsequent on_rx_refresh callback then accesses the freed memory, triggering the heap use-after-free.
5. Achieve denial of service: The memory corruption causes the PJSIP-based application to crash, resulting in service disruption for all users of the affected presence, MWI, or dialog-event service (GitHub Commit, GitHub Advisory).

• Network: Unexpected or repeated SIP SUBSCRIBE requests with Expires: 0 targeting the presence event package from unknown or external source IPs; unusual volume of unsubscription requests.
• Logs: Application crash logs or core dumps from the PJSIP-based process; AddressSanitizer output referencing heap-use-after-free in memcpy from pjrpid_add_element (rpid.c:128) or within evsub.c.
• Process: Unexpected termination or restart of the PJSIP-based service (e.g., Asterisk, FreeSWITCH, or custom SIP applications); watchdog or supervisor logs showing repeated process restarts.
• File System: Core dump files generated in the working directory of the SIP application following a crash (GitHub Commit).

Upgrade PJSIP to version 2.17 or later, which includes the fix in commit e06ff6c that defers the on_evsub_state(TERMINATED) callback until after on_rx_refresh completes. If an immediate upgrade is not possible, implement network-level controls (e.g., SIP-aware firewall rules or ACLs) to restrict SUBSCRIBE requests with Expires=0 from untrusted sources. Monitor for unusual presence unsubscription patterns as a compensating control (GitHub Advisory, GitHub Commit).

The vulnerability was credited to researcher arthurscchan as the finder, and the fix was developed with assistance from Claude Opus 4.6 as noted in the commit message. Red Hat tracked the issue via Bugzilla (Bug 2445116) with high severity. Tenable added detection support via Nessus plugin 301665. Community coverage has been limited to automated CVE tracking feeds and vulnerability databases, with no significant public researcher commentary or media coverage identified (GitHub Advisory, Red Hat Bugzilla, Tenable).