CVE-2026-32945: 
NixOS vulnerability analysis and mitigation

CVE-2026-32945 is a heap-based buffer overflow vulnerability in PJSIP's DNS parser name length handler, affecting PJSIP versions 2.16 and below. The flaw was discovered via fuzzing (fuzz-dns-records fuzzer) and disclosed on March 17–20, 2026, with a patch released in version 2.17. It affects applications using PJSIP's built-in DNS resolver configured via pjsua_config.nameserver or UaConfig.nameserver in PJSUA/PJSUA2. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.4 (High) (GitHub Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-131 (Incorrect Calculation of Buffer Size). It resides in the get_name_len() and get_name() functions within pjlib-util/src/pjlib-util/dns.c, where DNS name compression pointer handling fails to validate that the pointer p + 1 remains within the packet boundary (max) before performing a 2-byte memory copy. An attacker controlling a DNS response can craft a malicious packet with an out-of-bounds name length field, triggering a heap write beyond the allocated buffer. The fix (commit 5311aee) adds boundary checks (if (p + 1 >= max) return PJLIB_UTIL_EDNSINNAMEPTR;) in both affected functions (GitHub Commit, GitHub Advisory).

Successful exploitation can result in remote code execution, denial of service, or memory corruption on systems running vulnerable PJSIP-based applications. An unauthenticated remote attacker can compromise confidentiality, integrity, and availability of the affected system by sending a crafted DNS response. Applications not using PJSIP's built-in DNS resolver — those relying on the OS resolver (getaddrinfo()) or an external resolver via pjsip_resolver_set_ext_resolver() — are not affected (Red Hat Bugzilla, GitHub Advisory).

No public proof-of-concept exploit or active in-the-wild exploitation has been observed as of the time of reporting. The EPSS score is approximately 0.042%, reflecting low current exploitation probability. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. A Nessus detection plugin (ID 304102) is available for scanning (Feedly, Tenable).

1. Reconnaissance: Identify applications using PJSIP versions 2.16 or below with the built-in DNS resolver enabled (i.e., nameserver_count > 0 in configuration). VoIP applications, SIP clients, and communication servers built on PJSUA/PJSUA2 are prime targets.
2. Set up a rogue DNS server: Deploy a malicious DNS server or perform a DNS spoofing/man-in-the-middle attack to intercept DNS queries from the target application.
3. Craft a malicious DNS response: Construct a DNS response packet containing a name compression pointer that points near or beyond the end of the packet buffer, causing p + 1 >= max to be true without the (pre-patch) boundary check — triggering an out-of-bounds 2-byte read/write in get_name_len() or get_name().
4. Trigger DNS resolution: Cause the target PJSIP application to perform a DNS lookup (e.g., by initiating a SIP call or registration that requires DNS resolution of a SIP server hostname).
5. Achieve heap corruption: The crafted response causes a heap buffer overflow in the DNS parser, potentially overwriting adjacent heap metadata or function pointers to achieve arbitrary code execution or crash the application (GitHub Advisory, GitHub Commit).

• Network: Anomalous DNS responses directed at PJSIP-based applications containing malformed name compression pointers; unexpected DNS traffic from non-authoritative or unknown DNS servers to VoIP/SIP endpoints.
• Logs: Application crash logs or core dumps from PJSIP-based processes following DNS resolution events; error messages referencing PJLIB_UTIL_EDNSINNAMEPTR (on patched versions detecting the condition).
• Process: Unexpected termination or restart of SIP/VoIP application processes (e.g., Asterisk, FreeSWITCH, or custom PJSUA2 apps) coinciding with DNS lookup activity; unusual child processes spawned by the SIP application process.
• File System: Core dump files generated by PJSIP-based applications in the working directory following DNS resolution failures.

Upgrade PJSIP to version 2.17 or later, which includes the fix in commit 5311aee addressing the missing boundary checks in get_name_len() and get_name(). For users unable to upgrade immediately, two workarounds are available: (1) disable PJSIP's built-in DNS resolver by setting nameserver_count to zero in the PJSIP configuration, or (2) configure an external DNS resolver using pjsip_resolver_set_ext_resolver(). Users who already rely on the OS resolver (getaddrinfo()) without configuring a nameserver are not affected and require no action (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was credited to researcher arthurscchan and was identified through fuzzing via the fuzz-dns-records fuzzer, highlighting the value of continuous fuzz testing for multimedia communication libraries. Red Hat tracked the issue via Bugzilla and classified it as high severity. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been observed (GitHub Advisory, Red Hat Bugzilla).