Critical severity9.8NVD Advisory· Published Feb 16, 2022· Updated Jun 17, 2026

CVE-2021-43299

Description

Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pjsip/Pjsip2 versions
cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:*range: <=2.11.1
- (no CPE)range: unspecified
Debian/linux3 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Pjsip/Pjprojectllm-fuzzy

Patches

Vulnerability mechanics

References

github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9nvdPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2022/03/msg00035.htmlnvdMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2022/11/msg00021.htmlnvdMailing ListThird Party Advisory
www.debian.org/security/2022/dsa-5285nvdThird Party Advisory
lists.debian.org/debian-lts-announce/2023/08/msg00038.htmlnvd
lists.debian.org/debian-lts-announce/2024/09/msg00030.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000