CVE-2026-34235Critical· 9.1▾ MidnightPJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap out-of-bounds read vulnerability exists in PJSIP's VP9 RTP unpacketizer that occurs when parsing crafted VP9 Scalability Structu…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap out-of-bounds read vulnerability exists in PJSIP's VP9 RTP unpacketizer that occurs when parsing crafted VP9 Scalability Structure (SS) data. Insufficient bounds checking on the payload descriptor length may cause reads beyond the allocated RTP payload buffer. This issue has been patched in version 2.17. A workaround for this issue involves disabling VP9 codec if not needed.
pjsip < 2.17Upgrade past the affected range:
pjsip 2.17Connected by shared product, vendor, weakness, or advisory.
CVE-2026-57161High· 8.2PJSIP is a free and open source multimedia communication library written in C
CVE-2026-57162Critical· 9.1PJSIP is a free and open source multimedia communication library written in C
CVE-2026-57163Critical· 9.1PJSIP is a free and open source multimedia communication library written in C
CVE-2026-57166Medium· 5.3PJSIP is a free and open source multimedia communication library written in C
CVE-2026-57165Medium· 5.3PJSIP is a free and open source multimedia communication library written in C
CVE-2026-57160Medium· 5.3PJSIP is a free and open source multimedia communication library written in C