Vulnerability · Published Feb 20, 2026 · Assigned by GitHub_M
CVE-2026-26967PJSIP has a Heap-based Buffer Overflow vulnerability in its H.264 unpacketizer
High 8.1
In plain English
A high-severity heap buffer overflow in pjproject from pjsip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
PJSIP is a free and open source multimedia communication library written in C. In versions 2.16 and below, there is a critical Heap-based Buffer Overflow vulnerability in PJSIP's H.264 unpacketizer. The bug occurs when processing malformed SRTP packets, where the unpacketizer reads a 2-byte NAL unit size field without validating that both bytes are within the payload buffer bounds. The vulnerability affects applications that receive video using H.264. A patch is available at https://github.com/pjsip/pjproject/commit/f821c214e52b11bae11e4cd3c7f0864538fb5491.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | pjproject | 2.17-r0 | ALPINE-CVE-2026-26967 |
| Debian:14 | asterisk | 1:22.10.0+dfsg+~cs6.17.60671434-1 | DEBIAN-CVE-2026-26967 |
Affected products (as reported)
Weakness: CWE-122 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U