CVE-2026-26967: PJSIP has a Heap-based Buffer Overflow vulnerability in its H.264 unpacketizer
PJSIP is a free and open source multimedia communication library written in C. In versions 2.16 and below, there is a critical Heap-based Buffer Overflow vulnerability in PJSIP's H.264 unpacketizer. The bug occurs when processing malformed SRTP packets, where the unpacketizer reads a 2-byte NAL unit size field without validating that both bytes are within the payload buffer bounds. The vulnerability affects applications that receive video using H.264. A patch is available at https://github.com/pjsip/pjproject/commit/f821c214e52b11bae11e4cd3c7f0864538fb5491.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26967?
CVE-2026-26967 is classified as a critical vulnerability due to the risk of heap-based buffer overflow.
How does CVE-2026-26967 affect PJSIP?
CVE-2026-26967 affects PJSIP versions 2.16 and below, leading to potential exploitation of the H.264 unpacketizer.
How do I fix CVE-2026-26967?
To fix CVE-2026-26967, upgrade your PJSIP installation to version 2.17 or later.
What types of attacks can CVE-2026-26967 allow?
CVE-2026-26967 can allow remote attackers to execute arbitrary code on affected systems.
In which versions of PJSIP is CVE-2026-26967 present?
CVE-2026-26967 is present in PJSIP versions 2.16 and earlier versions.