CVE-2026-57166

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>pjsip</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>PJSIP is a free and open source multimedia communication library
	written in C. Prior to commit 4472a31, a stack buffer overflow exists
	in the PJLIB-UTIL telnet CLI front-end when rendering feedback for an
	entered command line. Several command-line handling paths write an
	attacker-influenced amount of data into fixed-size buffers without
	sufficient bounds checking, so a long command line can overflow them.
	This affects only applications that enable the telnet CLI front-end
	(e.g. pj_cli_telnet_create() / --cli-telnet-port). The telnet CLI is
	an interactive administration interface with no authentication, so any
	client able to reach it can already issue arbitrary CLI commands. A
	malformed or overly long command line can overflow a fixed-size stack
	buffer while rendering command-line feedback, which may lead to
	application termination. Because reaching this code already requires
	access to the unauthenticated CLI, the impact beyond that existing
	access is limited. Applications that do not enable the telnet CLI
	front-end are not affected. This issue has been patched via commit
	4472a31.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-57166</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-57166</url>
    </references>
    <dates>
      <discovery>2026-09-04</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>