Critical severity9.8NVD Advisory· Published Apr 6, 2022· Updated Jun 17, 2026

CVE-2022-24786

Description

PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A patch is available in the master branch of the pjsip/pjproject GitHub repository. There are currently no known workarounds.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pjsip/Pjsip2 versions
cpe:2.3:a:pjsip:pjsip:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:pjsip:pjsip:*:*:*:*:*:*:*:*range: <=2.12
- (no CPE)range: <=2.12
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Pjsip/Pjprojectcpe-rescue
Range: <= 2.12

Patches

Vulnerability mechanics

References

github.com/pjsip/pjproject/commit/11559e49e65bdf00922ad5ae28913ec6a198d508nvdPatchThird Party Advisory
github.com/pjsip/pjproject/security/advisories/GHSA-vhxv-phmx-g52qnvdThird Party Advisory
lists.debian.org/debian-lts-announce/2022/11/msg00021.htmlnvdMailing ListThird Party Advisory
security.gentoo.org/glsa/202210-37nvdThird Party Advisory
www.debian.org/security/2022/dsa-5285nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000