CVE-2026-77396: PJSIP: Heap buffer overflow in the AVI parser
PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/aviplayer.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media dimensions. A crafted AVI file can therefore cause an attacker-controlled out-of-bounds write past the heap allocation when an application plays the file or pulls its frames. The existing size assertion does not protect production release builds, where assertions are disabled. Typical local playback can crash the process, while applications that accept untrusted AVI sources expose a stronger memory-corruption condition. No fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Which deployments have the greatest exposure?
Applications that accept AVI files from untrusted sources are at greatest risk because a crafted file can trigger an attacker-controlled heap out-of-bounds write. Local playback of a malicious file can also crash the process.
What must an attacker do to trigger the issue?
The attacker needs to provide a crafted AVI file and have the application play it or pull frames from it. The malicious video chunk length is used for a copy into a buffer sized from the declared media dimensions.
Does the existing size assertion protect production builds?
No. The assertion does not protect production release builds because assertions are disabled there.
What can be done while no fixed version is available?
Prevent affected applications from playing or extracting frames from untrusted AVI files. Treat AVI supplied by users, remote sources, or other untrusted inputs as potentially malicious until a fix is available.