CVE-2022-21723

CRITICAL

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior...

Affects 4 products across 4 vendors.

CVSS 3.19.1
EPSS4.4%
Percentile91th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, no integrity impact, full availability impact.
CWE Weakness Definitions
CWE-125: Out-of-Bounds Read

Software reads data past the boundary of an allocated buffer, leaking sensitive information or causing crashes.

Related Attack Patterns (CAPEC)
CAPEC-540 Overread Buffers
via CWE-125

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

CVE-2022-21723 affects PJSIP versions 2.11.1 and prior, causing an out-of-bound read access when parsing malformed multipart SIP messages.

BSID: BS-2022-GLOBAL-311964-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-21723?
CVE-2022-21723 affects PJSIP versions 2.11.1 and prior, causing an out-of-bound read access when parsing malformed multipart SIP messages.
What is the CVSS score for CVE-2022-21723?
CVE-2022-21723 has CVSS 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS: 4.4%.
Is CVE-2022-21723 actively exploited?
No confirmed active exploitation of CVE-2022-21723 as of 2026-09-25.
How do I remediate CVE-2022-21723?
Priority: IMMEDIATE.
What systems are affected by CVE-2022-21723?
CVE-2022-21723 affects Asterisk Certified Asterisk; Debian Debian Linux; Sangoma Asterisk; Teluu Pjsip.
Vulnerability Details
CVE IDCVE-2022-21723
BSIDBS-2022-GLOBAL-311964-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Published2022-01-27
Last Modified2026-06-17
ICS Relevance15%
Weakness (CWE)
Out-of-Bounds Read
SourceNVD
Official Description

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by sending a specially crafted SIP message with a malformed multipart body to a PJSIP server or client that accepts SIP multipart messages.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Asterisk Certified Asterisk 16.8.0
Debian Debian Linux 9.0 10.0
Sangoma Asterisk ≥ 16.0.0, < 16.24.1 ≥ 18.0.0, < 18.10.1 ≥ 19.0.0, < 19.2.1
Teluu Pjsip ≤ 2.11.1
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1723 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashe75730d828fb58195ee45be21d820be39b35ed9a4aac7257a4ab502e735164904b70e01f40701b05a487c8ebbb3e6ced5756306655eb32433fbc7721514f88a4
Related CVEs affecting Asterisk
CVE-2007-2488 10.0 The IAX2 channel driver (chan_iax2) in Asterisk before 20070504 does not prop... CVE-2021-37706 9.8 PJSIP is a free and open source multimedia communication library written in C... CVE-2022-23608 9.8 PJSIP is a free and open source multimedia communication library written in C... CVE-2008-1390 9.3 The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 a... CVE-2007-3762 9.3 Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asteris...
View all Asterisk CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.1 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →