CVE-2026-103109: Input Validation
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a denial of service. A crafted media stream may result in a controlled abort during processing, and has the potential to achieve memory corruption.
Affected Software
Event History
Frequently Asked Questions
Which Pexip Infinity releases are affected?
Affected releases are versions before 38.2, as well as 39.0, 39.1, and 40.0.
What must an attacker do to exploit this issue?
An attacker must remotely provide a crafted media stream that reaches the vulnerable media-processing implementation. No privileges or user interaction are required, but the attack complexity is rated high.
What is the likely impact of a successful attack?
Processing the crafted stream can cause a controlled software abort and denial of service. The issue also has potential to cause memory corruption, with low confidentiality impact and high integrity and availability impact.