CVE-2026-34235: PJSIP: Heap OOB read in VPX unpacketizer
PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap out-of-bounds read vulnerability exists in PJSIP's VP9 RTP unpacketizer that occurs when parsing crafted VP9 Scalability Structure (SS) data. Insufficient bounds checking on the payload descriptor length may cause reads beyond the allocated RTP payload buffer. This issue has been patched in version 2.17. A workaround for this issue involves disabling VP9 codec if not needed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PJSIPto a version that resolves this vulnerability.Fixed in 2.17 - Configuration
Disable the VP9 codec if not needed (workaround for the VP9 RTP unpacketizer heap OOB read).
PJSIP VP9 codec (RTP unpacketizer) VP9 codec enabled = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34235?
CVE-2026-34235 has been classified as a moderate severity vulnerability due to the potential for heap out-of-bounds read which can lead to information leakage.
How do I fix CVE-2026-34235?
To mitigate CVE-2026-34235, upgrade your version of PJSIP to 2.17 or later where the vulnerability has been patched.
What software versions are affected by CVE-2026-34235?
CVE-2026-34235 affects PJSIP versions prior to 2.17.
What type of vulnerability is CVE-2026-34235?
CVE-2026-34235 is a heap out-of-bounds read vulnerability found in the VP9 RTP unpacketizer of PJSIP.
Can CVE-2026-34235 be exploited remotely?
Yes, CVE-2026-34235 can potentially be exploited remotely through crafted VP9 data sent to the PJSIP application.