CVE-2026-26203 PJSIP's pjmedia-video has use-after-free in H264 packetizer when packetizing fragmented NAL

What is CVE-2026-26203?

CVE-2026-26203 is a medium-severity use after free vulnerability in pjsip pjmedia-video, published on 19 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing malformed H.264 bitstreams without NAL unit start codes, where the packetizer performs unchecked pointer arithmetic that can read from memory located before the allocated buffer. Version 2.17 contains a patch for the issue.

Weakness: CWE-416

Which versions are affected by CVE-2026-26203?

It affects 1 product.

Products include Pjsip Pjsip.

How do I fix CVE-2026-26203?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-26203 being exploited?

There is no known exploitation of CVE-2026-26203 in the wild and no public exploit code.

Other vulnerabilities in pjsip pjmedia-video

• CVE-2026-28799 PJSIP: Heap use-after-free in PJSIP presence subscription termination handler High 8.7
• CVE-2026-29068 PJSIP: Stack buffer overflow in Opus codec parser High 8.7
• CVE-2026-40614 PJSIP: Heap buffer overflow in Opus codec decoding High 8.5
• CVE-2026-32945 PJSIP is vulnerable to Heap-based Buffer Overflow through DNS parser High 8.4
• CVE-2026-40892 PJSIP: Stack buffer overflow in pjsip_auth_create_digest2() High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-26203, DEBIAN-CVE-2026-26203, GHSA-p965-mf7j-gwv8, UBUNTU-CVE-2026-26203.