PT-2026-20921 · Pjsip · Pjsip

Arthurscchan · Published 2026-02-19 · Updated 2026-02-23 · CVE-2026-26203

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PJSIP versions prior to 2.17

Description PJSIP, a multimedia communication library, contains a heap buffer underflow issue in its H.264 packetizer. This occurs when processing H.264 bitstreams lacking NAL unit start codes, leading to unchecked pointer arithmetic and potential memory access outside the allocated buffer. Exploitation of this issue, through malformed H.264 video sent over a network, can result in crashes or code execution.

Recommendations Upgrade to version 2.17 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-26203

GHSA-P965-MF7J-GWV8

Affected Products

Pjsip

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26203.json · Exploit
• https://github.com/pjsip/pjproject/security/advisories/GHSA-p965-mf7j-gwv8 · Vendor Advisory
• https://github.com/pjsip/pjproject/commit/5aee54f09d4f91538d55279d7316591b28fded6c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-26203 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-26203 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-26203 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26203 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-26203 · Security Note
• https://ubuntu.com/security/CVE-2026-26203 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-26203 · Vendor Advisory
• https://twitter.com/CVEnew/status/2025809093588578791 · Twitter Post
• https://twitter.com/VolerionSec/status/2024592187434897555 · Twitter Post