VulnSocial

CVE-2026-26967Disclosure(pjsip / pjsip)

LOWCVSS 5.3 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Patch pjsip pjsip systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

PJSIP is a free and open source multimedia communication library written in C. In versions 2.16 and below, there is a critical Heap-based Buffer Overflow vulnerability in PJSIP's H.264 unpacketizer. The bug occurs when processing malformed SRTP packets, where the unpacketizer reads a 2-byte NAL unit size field without validating that both bytes are within the payload buffer bounds. The vulnerability affects applications that receive video using H.264. A patch is available at https://github.com/pjsip/pjproject/commit/f821c214e52b11bae11e4cd3c7f0864538fb5491.

pjsip CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-122

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • pjsip

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • 3 total mentions across 1 day

Affected systems

Vendors
pjsip
Products
pjsip

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-02-20: 3Patch / Workaround · 2026-02-20: 1Technical Details · 2026-02-20: 302-20
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets4 URLs
Full discourse3 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-26967 Heap-Based Buffer Overflow in PJSIP H.264 Unpacketizer Versions 2.16 and... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26967 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3

    Post summary

    The tweet announces a heap-based buffer overflow in PJSIP H.264 Unpacketizer v2.16, linking to more details but providing no PoC, exploit code, or patch information.

    0001175
    4.0K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-26967 PJSIP is a free and open source multimedia communication library written in C. In versions 2.16 and below, there is a critical Heap-based Buffer Overflow vulnerabilit… https://www.cve.org/CVERecord?id=CVE-2026-26967

    Post summary

    The statement announces CVE-2026-26967, a heap-based buffer overflow in PJSIP 2.16 and earlier, without providing PoC, exploit, patch, or active exploitation details.

    0000094
    56.4K followersView on X
  • Volerion@VolerionSec
    Patch

    🚨 CVE-2026-26967: Heap overflow in PJSIP’s H.264 unpacketizer lets remote attackers crash apps or run code without authentication. Upgrade to 2.17 ASAP! Full advisory ➡️ https://volerion.com/vulnerabilities/CVE-2026-26967 #VoIP #infosec #AppSec

    Post summary

    CVE-2026-26967 is a heap overflow in PJSIP’s H.264 unpacketizer enabling remote code execution; users are urged to upgrade to version 2.17 to mitigate the risk.

    0000067
    50 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apppjsippjsip---

Explore more

Back to dashboardpjsip CVEspjsip vulnerabilities