CVE-2026-33069: 
NixOS vulnerability analysis and mitigation

CVE-2026-33069 is an out-of-bounds heap read vulnerability in the pjsip_multipart_parse() function of PJSIP, a free and open-source multimedia communication library written in C. The flaw affects PJSIP versions 2.16 and below, and was disclosed on March 20, 2026, with a patch released in version 2.17. All applications that process incoming SIP messages with multipart bodies or SDP content are potentially affected. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a missing bounds check (CWE-125: Out-of-bounds Read) in the pjsip_multipart_parse() function within pjsip/src/pjsip/sip_multipart.c. After matching a boundary string delimiter, the internal pointer curptr is advanced past the delimiter without first verifying that it has not reached the end of the buffer. This allows an attacker to trigger a read of 1–2 bytes of adjacent heap memory beyond the intended buffer boundary. The vulnerability is exploitable remotely over the network with no authentication or user interaction required, simply by sending a crafted SIP message with a malformed multipart body or SDP content (GitHub Advisory, GitHub Commit).

Successful exploitation allows a remote, unauthenticated attacker to read 1–2 bytes of adjacent heap memory per crafted SIP message, potentially exposing sensitive data such as authentication tokens, session identifiers, or other confidential information residing in heap memory. There is no integrity or availability impact associated with this vulnerability; the risk is confined to confidentiality. Applications acting as SIP servers or proxies that accept messages from untrusted sources are at greatest risk, as they process multipart SIP bodies or SDP content by design (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify internet-facing SIP servers or applications built on PJSIP versions 2.16 or below using tools such as Shodan (searching for SIP banners) or SIP scanning utilities like svmap from SIPVicious.
2. Craft malicious SIP message: Construct a SIP INVITE or MESSAGE request containing a Content-Type: multipart/mixed header with a carefully crafted boundary parameter designed to position curptr at or near the end of the buffer after delimiter matching.
3. Send the crafted request: Transmit the malformed SIP message to the target over UDP or TCP on port 5060 (or 5061 for TLS) without requiring any authentication credentials.
4. Trigger out-of-bounds read: The pjsip_multipart_parse() function advances curptr past the boundary delimiter without a bounds check, causing it to read 1–2 bytes of adjacent heap memory.
5. Extract leaked data: Analyze SIP error responses or application behavior to infer the content of the leaked heap bytes, potentially recovering fragments of authentication tokens, session data, or other sensitive information (GitHub Advisory, GitHub Commit).

• Network: Unusual or malformed SIP INVITE/MESSAGE requests on port 5060/5061 with Content-Type: multipart/mixed headers containing anomalous or truncated boundary parameters; repeated SIP requests from a single source IP targeting multipart parsing endpoints.
• Logs: SIP application logs showing parsing errors or unexpected behavior in pjsip_multipart_parse(); crash reports or memory fault logs from PJSIP-based processes; elevated rate of SIP 400 Bad Request or 500 Server Error responses correlated with multipart-body messages.
• Process: Unexpected memory access violations or segmentation faults in PJSIP-based processes; heap inspection tools (e.g., Valgrind) reporting out-of-bounds reads in sip_multipart.c.

The primary remediation is to upgrade PJSIP to version 2.17 or later, which includes the fix introduced in commit f0fa32a226df5f87a9903093e5d145ebb69734db that adds a bounds check before advancing curptr past the boundary delimiter. For organizations unable to patch immediately, applying network-level controls to restrict SIP traffic (ports 5060/5061) to trusted endpoints only will reduce exposure. Monitoring and filtering inbound SIP messages with malformed multipart bodies at the SIP proxy or firewall layer can also serve as a temporary mitigation (GitHub Advisory, GitHub Commit, Red Hat Bugzilla).

Red Hat tracked the issue via Bugzilla (Bug 2449569) and classified it as medium severity, assigning it to their Product Security DevOps Team for assessment. The advisory was published by PJSIP maintainer sauwming on GitHub on March 17, 2026, ahead of the CVE's public disclosure on March 20, 2026. Community discussion has been limited, consistent with the low EPSS score and absence of active exploitation (Red Hat Bugzilla, GitHub Advisory).