Vulnerability · Published Feb 19, 2026 · Assigned by GitHub_M
CVE-2026-26203PJSIP's pjmedia-video has use-after-free in H264 packetizer when packetizing fragmented NAL
Medium 5.1
In plain English
A medium-severity use-after-free in pjmedia-video from pjsip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing malformed H.264 bitstreams without NAL unit start codes, where the packetizer performs unchecked pointer arithmetic that can read from memory located before the allocated buffer. Version 2.17 contains a patch for the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | pjproject | 2.17-r0 | ALPINE-CVE-2026-26203 |
| Debian:14 | asterisk | 1:22.10.0+dfsg+~cs6.17.60671434-1 | DEBIAN-CVE-2026-26203 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| pjsip | pjmedia-video | < 2.17 |
Weakness: CWE-416 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L