CVE-2026-33069
Last modified
CVE-2026-33069 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a cascading out-of-bounds heap read in pjsip_multipart_parse(). EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a cascading out-of-bounds heap read in pjsip_multipart_parse(). After boundary string matching, curptr is advanced past the delimiter without verifying it has not reached the buffer end. This allows 1-2 bytes of adjacent heap memory to be read. All applications that process incoming SIP messages with multipart bodies or SDP content are potentially affected. This issue is resolved in version 2.17.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pjsip | Pjsip | < 2.17 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-33069?
How severe is CVE-2026-33069?
How do I fix CVE-2026-33069?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-33063free5GC is an open source 5G core network. free5GC AUSF prio…7.5
- CVE-2026-33064Free5GC is an open-source Linux Foundation project for 5th g…7.5
- CVE-2026-33065Free5GC is an open-source Linux Foundation project for 5th g…5.3
- CVE-2026-33066SiYuan is a personal knowledge management system. In version…9
- CVE-2026-33067SiYuan is a personal knowledge management system. Versions 3…9
- CVE-2026-33068Claude Code is an agentic coding tool. Versions prior to 2.1…8.8
- CVE-2026-3307An authorization bypass vulnerability was identified in GitH…2.7
- CVE-2026-33070FileRise is a self-hosted web file manager / WebDAV server. …4.8
- CVE-2026-33071FileRise is a self-hosted web file manager / WebDAV server. …8.8
- CVE-2026-33072FileRise is a self-hosted web file manager / WebDAV server. …7.5
- CVE-2026-33073Discourse is an open-source discussion platform. From versio…5.3
- CVE-2026-33074Discourse is an open-source discussion platform. From versio…5.3
Are you affected by CVE-2026-33069?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST