pjsip up to 2.16 heap-based overflow

Summaryinfo

A vulnerability marked as critical has been reported in pjsip up to 2.16. Affected is an unknown function. This manipulation causes heap-based overflow. This vulnerability is handled as CVE-2026-26967. The attack can be initiated remotely. There is not any exploit available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability has been found in pjsip up to 2.16 and classified as critical. Affected by this vulnerability is an unknown code. The manipulation with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

PJSIP is a free and open source multimedia communication library written in C. In versions 2.16 and below, there is a critical Heap-based Buffer Overflow vulnerability in PJSIP's H.264 unpacketizer. The bug occurs when processing malformed SRTP packets, where the unpacketizer reads a 2-byte NAL unit size field without validating that both bytes are within the payload buffer bounds. The vulnerability affects applications that receive video using H.264. A patch is available at https://github.com/pjsip/pjproject/commit/f821c214e52b11bae11e4cd3c7f0864538fb5491.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-26967 since 02/16/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 299828 (Linux Distros Unpatched Vulnerability : CVE-2026-26967), which helps to determine the existence of the flaw in a target environment.

Applying the patch f821c214e52b11bae11e4cd3c7f0864538fb5491 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at Tenable (299828). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• pjsip

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion