CVE-2022-21723 CRITICAL

CVE-2022-21723: Out-of-bounds read in multipart parsing in PJSIP

Vendor Pjsip
Product pjproject
Weakness CWE-125
Published January 27, 2022
Last update November 4, 2025
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

What the vulnerability does

01Description

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.

Key dates

02Disclosure timeline

January 27, 2022 CVE published
November 4, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-34242 Adobe Character Animator SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability CVE-2024-30359 Foxit PDF Reader AcroForm 3D Out-Of-Bounds Read Remote Code Execution Vulnerability CVE-2026-25258 Out-of-bounds Read in DSP Service CVE-2023-47040 ZDI-CAN-21698: Adobe Media Encoder MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability CVE-2024-12549 Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability