Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-26967: PJSIP video reception may cause application crash

CVE-2026-26967 · published 8 months ago

Summary

Versions of the PJSIP library up to 2.16 used in products such as pjsip, Debian's Asterisk and Alpine's pjproject can mishandle specially crafted video packets, leading to memory overflow and possible crashes. The issue occurs when the software reads video data without checking its size first. Updating to the latest version that includes the provided fix will resolve the risk.

What to do

Update alpine pjproject to version 2.17-r0.
Update pjsip pjsip to version 2.17 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	pjsip	pjsip	< 2.17 `cpe:2.3:a:pjsip:pjsip::::::::`
Debian:11	debian	asterisk	All versions
Alpine:v3.24	alpine	pjproject	< 2.17-r0 Fix: upgrade to 2.17-r0

Original advisory text

PJSIP has a Heap-based Buffer Overflow vulnerability in its H.264 unpacketizer

PJSIP is a free and open source multimedia communication library written in C. In versions 2.16 and below, there is a critical Heap-based Buffer Overflow vulnerability in PJSIP's H.264 unpacketizer. The bug occurs when processing malformed SRTP packets, where the unpacketizer reads a 2-byte NAL unit size field without validating that both bytes are within the payload buffer bounds. The vulnerability affects applications that receive video using H.264. A patch is available at https://github.com/pjsip/pjproject/commit/f821c214e52b11bae11e4cd3c7f0864538fb5491.

References

https://github.com/pjsip/pjproject/security/advisories/GHSA-x2hc-6969-g8v6 Vendor Advisory
https://github.com/pjsip/pjproject/commit/f821c214e52b11bae11e4cd3c7f0864538fb54... Patch
https://security-tracker.debian.org/tracker/CVE-2026-26967 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26967... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-26967 Vendor Advisory
https://security.alpinelinux.org/vuln/CVE-2026-26967 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

Timeline

Published20 Feb 2026

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2026-26967 · NVD

DEBIAN-CVE-2026-26967 · OSV

CVE-2026-26967 · OSV

GHSA-x2hc-6969-g8v6 · GHSA

ALPINE-CVE-2026-26967 · OSV

Track software like this

Free during beta