CVE-2026-29068: 
NixOS vulnerability analysis and mitigation

CVE-2026-29068 is a stack buffer overflow vulnerability in PJSIP's pjmedia-codec framework that allows unauthenticated remote attackers to cause a denial of service by sending a crafted RTP payload. It affects all PJSIP versions prior to 2.17, specifically impacting applications using Opus, Speex, or SILK codecs. The vulnerability was published on March 6, 2026, and patched in version 2.17. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat).

The root cause is a classic stack-based buffer overflow (CWE-121 / CWE-120) in the codec_parse() functions for the Opus, SILK, and Speex codecs within pjmedia-codec. These functions failed to check the caller-provided frames[] array capacity (*frame_cnt) before writing parsed frames; when an incoming RTP packet contained more frames than the array could hold, the loop wrote past the end of the stack-allocated buffer. The fix, applied in commit 6c90245, clamps the frame count to *frame_cnt before iterating and adds PJ_ASSERT_RETURN parameter sanity checks, consistent with other codec implementations (G711, G722, GSM, etc.) in the codebase. No authentication or user interaction is required, and the attack vector is network-accessible with low complexity (GitHub Commit, GitHub Advisory).

Successful exploitation causes a stack buffer overflow in the media processing layer, crashing the application and resulting in a denial of service. The vulnerability has a high availability impact with no confidentiality or integrity impact, meaning attackers cannot directly exfiltrate data or modify system state through this flaw alone. Any application embedding PJSIP and using Opus, Speex, or SILK codecs — including VoIP clients, SIP servers, and communication platforms — is at risk of service disruption (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.042%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Red Hat).

1. Reconnaissance: Identify targets running PJSIP-based applications (VoIP clients, SIP servers, conferencing software) using Opus, Speex, or SILK codecs on versions prior to 2.17 via SIP scanning tools such as SIPVicious or network enumeration.
2. Craft malicious RTP payload: Construct an RTP packet whose payload, when parsed by the vulnerable codec_parse() function, reports more frames than the receiver's stack-allocated frames[] buffer can hold.
3. Deliver the payload: Send the crafted RTP packet to the target over the network (UDP, typically on port 5004 or the negotiated RTP port) without requiring any authentication or prior session establishment.
4. Trigger the overflow: The vulnerable codec parser (Opus, SILK, or Speex) iterates beyond the bounds of the stack-allocated frames[] array, overwriting adjacent stack memory and causing an application crash (denial of service), confirmed by ASAN in testing (GitHub Commit, GitHub Advisory).

• Network: Unexpected or malformed RTP packets with anomalously high frame counts targeting UDP ports used for media streams (e.g., 5004 or dynamically negotiated RTP ports); repeated RTP packets from unknown or spoofed source IPs.
• Logs: Application crash logs or core dumps originating from pjmedia-codec functions (codec_parse, opus_codec_parse, silk_codec_parse, spx_codec_parse); ASAN reports indicating stack buffer overflow in pjmedia-codec.
• Process: Unexpected termination or restart of PJSIP-based processes (e.g., Asterisk, FreeSWITCH, or custom SIP applications); watchdog or supervisor logs showing repeated process restarts.
• File System: Core dump files generated by the PJSIP application process in the working directory or /var/crash/.

The primary remediation is to upgrade PJSIP to version 2.17 or later, which includes the fix in commit 6c90245 that clamps frame counts before iterating in the Opus, SILK, and Speex codec_parse() functions. No official configuration-based workaround has been published; however, organizations unable to upgrade immediately should consider restricting network access to RTP ports using firewall rules to limit exposure to trusted sources. Applications not using Opus, Speex, or SILK codecs are not affected by this specific vulnerability (GitHub Advisory, GitHub Commit).

The vulnerability was credited to researcher mfroeschl in the official GitHub Security Advisory. Red Hat tracked the issue via Bugzilla (Bug 2445115) with high priority and severity. Community discussion was observed on Bluesky and CVE tracking feeds shortly after disclosure, though no major media coverage or significant researcher commentary beyond the advisory has been identified (GitHub Advisory, Red Hat Bugzilla).