diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57161.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57161.patch
new file mode 100644
index 0000000000..3296013efd
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57161.patch
@@ -0,0 +1,49 @@
+From 656cd5ec76f0178448053a9ca44ce075cd7a27f9 Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:44:40 +0700
+Subject: [PATCH] Merge commit from fork
+
+Bound the number of Service-Route URIs stored in the fixed-size uri[]
+array by checking uri_cnt against PJ_ARRAY_SIZE(uri) before each write.
+Previously the count was only checked as the do/while continuation
+condition, which does not catch accumulation across multiple
+single-URI Service-Route headers, allowing a registrar response with
+more than PJSUA_ACC_MAX_PROXIES headers to write past the array.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit acc03b57cef7a7d31b8e1f5b9117437d7e87c591)
+
+CVE: CVE-2026-57161
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/acc03b57cef7a7d31b8e1f5b9117437d7e87c591]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjsip/src/pjsua-lib/pjsua_acc.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/pjsip/src/pjsua-lib/pjsua_acc.c b/pjsip/src/pjsua-lib/pjsua_acc.c
+index f52518a2a..08c5efced 100644
+--- a/pjsip/src/pjsua-lib/pjsua_acc.c
++++ b/pjsip/src/pjsua-lib/pjsua_acc.c
+@@ -2278,14 +2278,14 @@ static void update_service_route(pjsua_acc *acc, pjsip_rx_data *rdata)
+                 return;
+             }
+ 
++            if (uri_cnt >= PJ_ARRAY_SIZE(uri)) {
++                PJ_LOG(1,(THIS_FILE, "Error: too many Service-Route headers"));
++                return;
++            }
++
+             uri[uri_cnt++] = h->name_addr.uri;
+             h = h->next;
+-        } while (h != hr && uri_cnt != PJ_ARRAY_SIZE(uri));
+-
+-        if (h != hr) {
+-            PJ_LOG(1,(THIS_FILE, "Error: too many Service-Route headers"));
+-            return;
+-        }
++        } while (h != hr);
+ 
+         /* Prepare to find next Service-Route header */
+         hsr = hsr->next;
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index 254a2952a2..4c00c4215c 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -15,6 +15,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
 SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag=${PV} \
            file://0001-ssl_sock_ossl-fix-OpenSSL-4.0-compatibility.patch \
            file://CVE-2026-57160.patch \
+           file://CVE-2026-57161.patch \
            "
 SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"