by Kastro
Paper/Archive/CVE-2026-34235

CVE-2026-34235

pjsip pjproject — PJSIP: Heap OOB read in VPX unpacketizer

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
35
CVSS 9.1 (ADP, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 36.5.365 × 207.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap out-of-bounds read vulnerability exists in PJSIP's VP9 RTP unpacketizer that occurs when parsing crafted VP9 Scalability Structure (SS) data. Insufficient bounds checking on the payload descriptor length may cause reads beyond the allocated RTP payload buffer. This issue has been patched in version 2.17. A workaround for this issue involves disabling VP9 codec if not needed.

Affected

ProductAffectedFixed inSource
pjproject< 2.17–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
GitHub_M (CNA)6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/pjsip/pjproject/security/advisories/GHSA-pqrm-53pc-wx28refgithub.com/pjsip/pjproject/commit/f4c7d08211da1fe2ad1504434a0ad99d12aa7536