Is CVE-2026-33069 actively exploited?

No active exploitation of CVE-2026-33069 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33069 be exploited remotely?

Yes. CVE-2026-33069 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33069?

CVE-2026-33069 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-33069

HIGH

CVE-2026-33069

CWE-125Published: March 20, 2026· Updated: Mar 23, 2026

7.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.7th

Official Description

PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a cascading out-of-bounds heap read in pjsip_multipart_parse(). After boundary string matching, curptr is advanced past the delimiter without verifying it has not reached the buffer end. This allows 1-2 bytes of adjacent heap memory to be read. All applications that process incoming SIP messages with multipart bodies or SDP content are potentially affected. This issue is resolved in version 2.17.

NVD Source

Technical Analysis

CVE-2026-33069 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.