CVE-2026-26967 PJSIP has a Heap-based Buffer Overflow vulnerability in its H.264 unpacketizer

What is CVE-2026-26967?

CVE-2026-26967 is a high-severity memory corruption vulnerability in pjsip pjproject, published on 20 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

PJSIP is a free and open source multimedia communication library written in C. In versions 2.16 and below, there is a critical Heap-based Buffer Overflow vulnerability in PJSIP's H.264 unpacketizer. The bug occurs when processing malformed SRTP packets, where the unpacketizer reads a 2-byte NAL unit size field without validating that both bytes are within the payload buffer bounds. The vulnerability affects applications that receive video using H.264. A patch is available at https://github.com/pjsip/pjproject/commit/f821c214e52b11bae11e4cd3c7f0864538fb5491.

Weakness: CWE-122

Which versions are affected by CVE-2026-26967?

It affects 1 product.

Products include Pjsip Pjsip.

How do I fix CVE-2026-26967?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-26967 being exploited?

There is no known exploitation of CVE-2026-26967 in the wild and no public exploit code.

Other vulnerabilities in pjsip pjproject

• CVE-2026-28799 PJSIP: Heap use-after-free in PJSIP presence subscription termination handler High 8.7
• CVE-2026-29068 PJSIP: Stack buffer overflow in Opus codec parser High 8.7
• CVE-2026-40614 PJSIP: Heap buffer overflow in Opus codec decoding High 8.5
• CVE-2026-32945 PJSIP is vulnerable to Heap-based Buffer Overflow through DNS parser High 8.4
• CVE-2026-40892 PJSIP: Stack buffer overflow in pjsip_auth_create_digest2() High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-26967, DEBIAN-CVE-2026-26967, GHSA-x2hc-6969-g8v6, UBUNTU-CVE-2026-26967.