by Kastro
Paper/Archive/CVE-2026-103109

CVE-2026-103109

Pexip Infinity — Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a…

EPSS 0.3%CVSS 9.4
critical.is priorityof 100
32
CVSS 9.4 (NVD)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 16.9.169 × 203.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a denial of service. A crafted media stream may result in a controlled abort during processing, and has the potential to achieve memory corruption.

Affected

ProductAffectedFixed inSource
Infinity< 38.2.038.2.0CNA
Infinity39.0.0–CNA
Infinity39.1.0–CNA
Infinity40.0.0–CNA

Scores by source

NVD9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
mitre (CNA)7.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refdocs.pexip.com/admin/security_bulletins.htm