CVE-2026-26203 — MEDIUM (6.5)

Q: How severe is CVE-2026-26203?

CVE-2026-26203 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-26203?

Check the references section above for vendor advisories and patch information. Affected products include: Pjsip Pjsip.

Vulnerability Description

PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing malformed H.264 bitstreams without NAL unit start codes, where the packetizer performs unchecked pointer arithmetic that can read from memory located before the allocated buffer. Version 2.17 contains a patch for the issue.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Pjsip	Pjsip	< 2.17

Related Weaknesses (CWE)

CWE-416

References

FAQ

What is CVE-2026-26203?

CVE-2026-26203 is a vulnerability with a CVSS score of 6.5 (MEDIUM). PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing...

How severe is CVE-2026-26203?

CVE-2026-26203 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-26203?

Check the references section above for vendor advisories and patch information. Affected products include: Pjsip Pjsip.