CVE-2026-32942: 
NixOS vulnerability analysis and mitigation

CVE-2026-32942 is a heap use-after-free vulnerability in PJSIP's ICE (Interactive Connectivity Establishment) session handling, triggered by race conditions between session destruction and callbacks. It affects PJSIP versions 2.16 and below, and was disclosed on March 20, 2026, with a fix released in version 2.17. The vulnerability was discovered by researcher 'dhkts1' and published via GitHub Security Advisory GHSA-g88q-c2hm-q7p7 on March 10, 2026 (GitHub Advisory). It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 8.0 (High) (Red Hat).

The root cause is a heap use-after-free (CWE-416) combined with a signal handler race condition (CWE-364) in PJSIP's ICE session implementation. When the ICE session mutex is released to avoid a known deadlock (referenced in ticket #1451), a race window opens where the session object can be destroyed by another thread before the callback completes, leaving a dangling pointer that is subsequently accessed. The fix in commit c9caced addresses this by calling pj_grp_lock_add_ref() before releasing the group lock in both pj_ice_sess_send_data() and pj_ice_sess_on_rx_pkt(), and decrementing the reference after the callback returns, ensuring the session object is not prematurely freed (GitHub Commit, GitHub Advisory). Any PJSIP application that uses ICE is potentially affected.

Successful exploitation can result in arbitrary code execution or information disclosure, as memory corruption from the use-after-free condition may allow an attacker to control program flow or read sensitive heap contents. The vulnerability impacts confidentiality (unauthorized data access), integrity (data modification or corruption), and potentially availability through application crashes. Because the flaw is reachable over the network without authentication or user interaction, it poses a significant risk to any internet-exposed VoIP or multimedia application built on PJSIP (Red Hat Bugzilla, GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (Red Hat). The EPSS score is approximately 0.04%, reflecting a currently low probability of exploitation in the near term. The attack complexity is rated High (CVSS v3.1) due to the timing requirements inherent in triggering a race condition, though no authentication or user interaction is required. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

The primary remediation is to upgrade PJSIP to version 2.17 or later, which contains the fix introduced in commit c9caced (GitHub Commit). No official configuration-based workaround has been published; organizations unable to patch immediately should implement network-level controls to restrict access to PJSIP-based services and monitor for anomalous behavior. Red Hat has tracked this issue as urgent severity and is assessing impact on affected products (Red Hat Bugzilla).

Red Hat classified the vulnerability as urgent severity and opened a tracking bug shortly after disclosure (Red Hat Bugzilla). The PJSIP maintainer published the security advisory and patch promptly via GitHub, crediting researcher 'dhkts1' as the finder (GitHub Advisory). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation.