PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34235 pjsip CVE debrief

A heap out-of-bounds read vulnerability exists in PJSIP's VP9 RTP unpacketizer prior to version 2.17. This issue occurs when parsing crafted VP9 Scalability Structure (SS) data. Insufficient bounds checking on the payload descriptor length may cause reads beyond the allocated RTP payload buffer. The CVE record was published on 2026-03-31T16:16:32.767Z and has not been modified since then. Users of PJSIP versions prior to 2.17 should apply the patch or consider disabling VP9 codec if not needed.

Vendor
pjsip
Product
pjproject
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-24
Advisory published
2026-03-31
Advisory updated
2026-07-24

Who should care

Users of PJSIP versions prior to 2.17 should apply the patch or consider disabling VP9 codec if not needed. This vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity. Operators, administrators, and security teams responsible for systems using PJSIP should review and address this vulnerability.

Technical summary

The vulnerability is caused by insufficient bounds checking on the payload descriptor length in PJSIP's VP9 RTP unpacketizer. This may lead to reads beyond the allocated RTP payload buffer when parsing crafted VP9 Scalability Structure (SS) data. The issue has been patched in version 2.17. A workaround involves disabling VP9 codec if not needed. Users should review their systems and apply the patch or mitigation as necessary.

Defensive priority

Medium priority should be given to applying the patch or mitigating the vulnerability by disabling VP9 codec if not needed. Defenders should focus on systems that are most likely to be exposed or have significant impact if exploited.

Recommended defensive actions

  • Apply the official patch by upgrading to PJSIP version 2.17 or later.
  • Disable VP9 codec if not needed as a temporary workaround.
  • Review and update affected systems and configurations.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The official patch is available in PJSIP version 2.17. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity. Evidence is limited to public sources and may not be comprehensive. Defenders should verify affected systems and apply patches or mitigations accordingly.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-03-31T16:16:32.767Z and has not been modified since then.