CVE-2026-57162

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>pjsip</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>PJSIP is a free and open source multimedia communication library
	written in C. Prior to commit a1b707c, a stack buffer overflow exists
	in the SRTP/SDES media transport when processing a=crypto attributes
	during SDP offer/answer (sdes_encode_sdp() in transport_srtp_sdes.c).
	This affects applications with SRTP enabled (use_srtp optional or
	mandatory, using SDES keying). During media negotiation, the crypto
	attributes from the remote SDP are collected into a fixed-size array
	without bounding their number; a remote peer that includes an
	excessive number of a=crypto attributes in a single media description
	can write past the end of that array on the stack. This is reachable
	from an incoming SIP INVITE during offer/answer, before
	application-level authentication. Impact may range from unexpected
	application termination to control flow hijack/memory corruption.
	Applications that do not enable SRTP are not affected. This issue has
	been patched via commit a1b707c.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-57162</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-57162</url>
    </references>
    <dates>
      <discovery>2026-09-04</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>