Executive brief
PJSIP is a widely used open-source library for multimedia communications, such as VoIP and video conferencing. A security flaw in how the library handles VP9 video data allows a remote attacker to send a specially crafted video stream that triggers an out-of-bounds memory read. This could lead to the exposure of sensitive information from the application's memory or cause the communication service to crash, resulting in a service outage.
Technical details
A heap out-of-bounds read vulnerability (CWE-125) exists in PJSIP's VP9 RTP unpacketizer within the pjmedia-codec component. The root cause is insufficient bounds checking on the payload descriptor length when parsing VP9 Scalability Structure (SS) data. Specifically, the code fails to verify if the incremented descriptor length exceeds the actual RTP payload buffer size. A remote, unauthenticated attacker can exploit this by sending a crafted VP9 RTP stream to an application with video support enabled. This can result in information disclosure or a denial-of-service (DoS) condition. The vulnerability is addressed in version 2.17 by adding explicit bounds checks during SS parsing.
Affected products
- Teluu PJSIP < 2.17
Timeline
- 2026-03-30: advisory: GitHub Security Advisory GHSA-pqrm-53pc-wx28 published
- 2026-03-31: disclosed: CVE-2026-34235 published to NVD
- 2026-03-31: patched: Fix committed to master branch (f4c7d08) and released in version 2.17