Unrated severityNVD Advisory· Published Feb 19, 2026· Updated Feb 19, 2026
PJSIP's pjmedia-video has use-after-free in H264 packetizer when packetizing fragmented NAL
CVE-2026-26203
Description
PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing malformed H.264 bitstreams without NAL unit start codes, where the packetizer performs unchecked pointer arithmetic that can read from memory located before the allocated buffer. Version 2.17 contains a patch for the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- pjsip/pjmedia-videov5Range: < 2.17
Patches
Vulnerability mechanics
References
2- github.com/pjsip/pjproject/commit/5aee54f09d4f91538d55279d7316591b28fded6cmitrex_refsource_MISC
- github.com/pjsip/pjproject/security/advisories/GHSA-p965-mf7j-gwv8mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.