PJSIP's pjmedia-video has use-after-free in H264 packetizer when packetizing fragmented NAL
Summary
PJSIP's pjmedia-video has use-after-free in H264 packetizer when packetizing fragmented NAL
Original description
The description as published by the source.
PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing malformed H.264 bitstreams without NAL unit start codes, where the packetizer performs unchecked pointer arithmetic that can read from memory located before the allocated buffer. Version 2.17 contains a patch for the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2026-26203 pjproject Fixed in: 2.17-r0
- Debian DEBIAN-CVE-2026-26203 asterisk
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com