Back
CVE-2022-21722
Potential out-of-bound read during RTP/RTCP parsing in PJSIP
Critical9.1EPSS 2.3%
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Critical9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| NVDNVD · Modified | 3.1 | Critical9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
- EPSS (exploitation in 30 days)
- 2.3% · top 16% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.1.
Weakness
Affected products
References (8)
- https://github.com/pjsip/pjproject/security/advisories/GHSA-m66q-q64c-hv36 (opens in a new tab)x_transferred
- https://github.com/pjsip/pjproject/commit/22af44e68a0c7d190ac1e25075e1382f77e9397a (opens in a new tab)x_transferred
- [debian-lts-announce] 20220328 [SECURITY] [DLA 2962-1] pjproject security update (opens in a new tab)mailing-listx_transferred
- GLSA-202210-37 (opens in a new tab)vendor-advisoryx_transferred
- [debian-lts-announce] 20221117 [SECURITY] [DLA 3194-1] asterisk security update (opens in a new tab)mailing-listx_transferred
- DSA-5285 (opens in a new tab)vendor-advisoryx_transferred
- [debian-lts-announce] 20230829 [SECURITY] [DLA 3549-1] ring security update (opens in a new tab)mailing-listx_transferred
- https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-21722)Record last updated .