CVE-2026-26203

Katalog CVE

CVSS 6.5 · Medium EPSS 0,15%

Kerentanan Use After Free pada pjsip. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing malformed H.264 bitstreams without NAL unit start codes, where the packetizer performs unchecked pointer arithmetic that can read from memory located before the allocated buffer. Version 2.17 contains a patch for the issue.

Rincian

Terbit di NVD

19 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 3,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pjsip/pjproject/security/advisories/GHSA-p965-mf7j-gwv8 patch · advisory vendor
• https://github.com/pjsip/pjproject/commit/5aee54f09d4f91538d55279d7316591b28fded6c patch