CVE-2022-23537 MEDIUM

CVE-2022-23537: PJSIP vulnerable to heap buffer overflow when decoding STUN message

Vendor Pjsip
Product pjproject
Weakness CWE-122
Published December 20, 2022
Last update November 4, 2025
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

What the vulnerability does

01Description

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown attribute. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as a commit in the master branch (2.13.1).

Key dates

02Disclosure timeline

December 20, 2022 CVE published
November 4, 2025 Record updated