# CVE-2026-34235: PJSIP heap out-of-bounds read in VP9 RTP unpacketizer

Source: https://junglewise.ai/threats/cve-2026-34235-pjsip-heap-out-of-bounds-read-in-vp9-rtp-unpacketizer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-34235 · Severity: critical · CVSS 9.1 · Published 2026-03-31

PJSIP is a widely used open-source library for multimedia communications, such as VoIP and video conferencing. A security flaw in how the library handles VP9 video data allows a remote attacker to send a specially crafted video stream that triggers an out-of-bounds memory read. This could lead to the exposure of sensitive information from the application's memory or cause the communication service to crash, resulting in a service outage.

Technologies: [Teluu Pjsip](https://junglewise.ai/threats/technologies/pjsip). Vendors: [Teluu](https://junglewise.ai/threats/vendors/teluu).

## Quick answers

**Is CVE-2026-34235 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34235 being exploited in the wild.

**How severe is CVE-2026-34235?** Critical severity, with a CVSS score of 9.1, published 31 March 2026.

**Which products and versions are affected?** Teluu Pjsip < 2.17.

**Is there a fix for CVE-2026-34235?** A patch was published on 2026-03-31: Fix committed to master branch (f4c7d08) and released in version 2.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34235 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-34235?** Check whether you run Teluu Pjsip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap out-of-bounds read vulnerability (CWE-125) exists in PJSIP's VP9 RTP unpacketizer within the pjmedia-codec component. The root cause is insufficient bounds checking on the payload descriptor length when parsing VP9 Scalability Structure (SS) data. Specifically, the code fails to verify if the incremented descriptor length exceeds the actual RTP payload buffer size. A remote, unauthenticated attacker can exploit this by sending a crafted VP9 RTP stream to an application with video support enabled. This can result in information disclosure or a denial-of-service (DoS) condition. The vulnerability is addressed in version 2.17 by adding explicit bounds checks during SS parsing.

## Affected products

- Teluu PJSIP < 2.17

## Timeline

- 2026-03-30: advisory: GitHub Security Advisory GHSA-pqrm-53pc-wx28 published
- 2026-03-31: disclosed: CVE-2026-34235 published to NVD
- 2026-03-31: patched: Fix committed to master branch (f4c7d08) and released in version 2.17

## References

- [https://github.com/pjsip/pjproject/commit/f4c7d08211da1fe2ad1504434a0ad99d12aa7536](https://github.com/pjsip/pjproject/commit/f4c7d08211da1fe2ad1504434a0ad99d12aa7536)
- [https://github.com/pjsip/pjproject/security/advisories/GHSA-pqrm-53pc-wx28](https://github.com/pjsip/pjproject/security/advisories/GHSA-pqrm-53pc-wx28)

## Related threats

- [PJSIP stack buffer overflow in telnet CLI](https://junglewise.ai/threats/cve-2026-57166-pjsip-stack-buffer-overflow-in-telnet-cli)
- [PJSIP stack buffer overflow in telnet CLI history redraw](https://junglewise.ai/threats/cve-2026-57165-pjsip-stack-buffer-overflow-in-telnet-cli-history-redraw)
- [PJSIP heap buffer overflow in HTTP client](https://junglewise.ai/threats/cve-2026-57164-pjsip-heap-buffer-overflow-in-http-client)
- [PJSIP stack buffer overflow in GnuTLS TLS backend](https://junglewise.ai/threats/cve-2026-57163-pjsip-stack-buffer-overflow-in-gnutls-tls-backend)
- [PJSIP stack buffer overflow in SRTP/SDES SDP processing](https://junglewise.ai/threats/cve-2026-57162-pjsip-stack-buffer-overflow-in-srtp-sdes-sdp-processing)