CVE-2026-26203

MEDIUM EPSS 1.1%
Published Feb 19, 20264mo ago · Modified Jun 17, 20262w ago
5.1 CVSS 4.0
Medium
Find Similar
Published Feb 19, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago

Description

PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing malformed H.264 bitstreams without NAL unit start codes, where the packetizer performs unchecked pointer arithmetic that can read from memory located before the allocated buffer. Version 2.17 contains a patch for the issue.

CVSS Details

Base Score
5.1
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
1.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 1

VendorProductVersionRange
pjsippjsip* <2.17

References 2

  • github.com https://github.com/pjsip/pjproject/commit/5aee54f09d4f91538d55279d7316591b28fded6c
    Patch
  • github.com https://github.com/pjsip/pjproject/security/advisories/GHSA-p965-mf7j-gwv8
    PatchVendor Advisory

Remediation

  • github.com https://github.com/pjsip/pjproject/commit/5aee54f09d4f91538d55279d7316591b28fded6c
    Patch
  • github.com https://github.com/pjsip/pjproject/security/advisories/GHSA-p965-mf7j-gwv8
    PatchVendor Advisory