CVE-2026-32942: Pjsip

High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days.

PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below contain a heap use-after-free vulnerability in the ICE session that occurs when there are race conditions between session destruction and the callbacks. This issue has been fixed in version 2.17.

Affected products

• Pjsip Pjsip: before 2.17 (fixed in 2.17)

Published 2026-03-20. Last modified 2026-06-17.