CVE-2026-26203: PJSIP's pjmedia-video has use-after-free in H264 packetizer when packetizing fragmented NAL
PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing malformed H.264 bitstreams without NAL unit start codes, where the packetizer performs unchecked pointer arithmetic that can read from memory located before the allocated buffer. Version 2.17 contains a patch for the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26203?
CVE-2026-26203 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-26203?
To mitigate CVE-2026-26203, upgrade PJSIP to version 2.17 or later.
What versions of PJSIP are affected by CVE-2026-26203?
CVE-2026-26203 affects all versions of PJSIP prior to 2.17.
What type of vulnerability is CVE-2026-26203?
CVE-2026-26203 is a heap buffer underflow vulnerability found in the H.264 packetizer.
What can happen if CVE-2026-26203 is exploited?
Exploitation of CVE-2026-26203 could lead to arbitrary code execution or crash of the application.