CVE-2026-41415: Teluu Pjsip

Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days.

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an out-of-bounds read when parsing a malformed Content-ID URI in SIP multipart message body. Insufficient length validation can cause reads beyond the intended buffer bounds. This vulnerability is fixed in 2.17.

Affected products

• Teluu Pjsip: before 2.17 (fixed in 2.17)

Published 2026-04-24. Last modified 2026-06-17.