Quick answers
- Is CVE-2026-103099 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-103099 being exploited in the wild.
- How severe is CVE-2026-103099?
- High severity, with a CVSS score of 7.5, published 30 September 2026.
- Which products and versions are affected?
- Pexip Infinity 18 through 41.0.
- Is there a fix for CVE-2026-103099?
- A patch was published on 2026: Version 41.1 addresses the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-103099 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-103099?
- Check whether you run Pexip Infinity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Improper input validation in the media processing component allows a remote attacker to trigger a controlled software abort via a crafted media stream, resulting in denial of service. The attack requires only network access with no authentication or user interaction, and affects Pexip Infinity versions 18 through 41.0. The fix is available in version 41.1 and later.
Affected products
- Pexip Infinity 18 through 41.0
Timeline
- 2026-09-30: disclosed
- 2026: patched: Version 41.1 addresses the vulnerability