Unrated severityNVD Advisory· Published Feb 19, 2026· Updated Feb 19, 2026
PJSIP's pjmedia-video has use-after-free in H264 packetizer when packetizing fragmented NAL
CVE-2026-26203
Description
PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing malformed H.264 bitstreams without NAL unit start codes, where the packetizer performs unchecked pointer arithmetic that can read from memory located before the allocated buffer. Version 2.17 contains a patch for the issue.
Affected products
2- pjsip/pjmedia-videov5Range: < 2.17
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- github.com/pjsip/pjproject/commit/5aee54f09d4f91538d55279d7316591b28fded6cmitrex_refsource_MISC
- github.com/pjsip/pjproject/security/advisories/GHSA-p965-mf7j-gwv8mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.