VDB
CVE-2026-26203
CVE-2026-26203
PUBLISHED
CVSS 9.300000190734863 CRITICAL
PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing malformed H.264 bitstreams without NAL unit start codes, where the packetizer performs unchecked pointer arithmetic that can read from memory located before the allocated buffer. Version 2.17 contains a patch for the issue.
EPSS 0.12% · 1.7th percentile
Risk Scores
CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS Score
0.12%
1.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| pjsip | pjsip | 0 |
| pjsip | pjmedia-video | < 2.17, < 2.17 |
Timeline
- Feb 11, 2026 CVE ID Reserved
- Feb 19, 2026 CVE Published
- Feb 19, 2026 CVE Updated
- Feb 20, 2026 EPSS Score
- Feb 22, 2026 EPSS Score
- Feb 24, 2026 EPSS Score
- Feb 26, 2026 EPSS Score
- Feb 28, 2026 EPSS Score
- Mar 2, 2026 EPSS Score
- Mar 4, 2026 EPSS Score
- Mar 6, 2026 EPSS Score
- Mar 8, 2026 EPSS Score