Critical severity · published Mar 31, 2026
CVE-2026-34235
PJSIP: Heap OOB read in VPX unpacketizer
9.1
CVSS
0.4%
EPSS
No
On KEV
Description
PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap out-of-bounds read vulnerability exists in PJSIP's VP9 RTP unpacketizer that occurs when parsing crafted VP9 Scalability Structure (SS) data. Insufficient bounds checking on the payload descriptor length may cause reads beyond the allocated RTP payload buffer. This issue has been patched in version 2.17. A workaround for this issue involves disabling VP9 codec if not needed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PJ
pjproject · pjsip
< 2.17 · source: vendor
PJ
Pjsip · Teluu
before 2.17 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34235
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34235
Patch
https://github.com/pjsip/pjproject/commit/f4c7d08211da1fe2ad1504434a0ad99d12aa7536
Patch
https://github.com/pjsip/pjproject/security/advisories/GHSA-pqrm-53pc-wx28
More from pjproject
9.8
CVE-2026-40892
PJSIP: Stack buffer overflow in pjsip_auth_create_digest2()
9.8
CVE-2026-32945
PJSIP is vulnerable to Heap-based Buffer Overflow through DNS parser
9.8
CVE-2026-25994
PJSIP has a heap buffer overflow in ICE with long username
9.8
CVE-2022-39244
Buffer overflow in pjlib scanner and pjmedia
9.1
CVE-2026-57163
PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend