What is CVE-2026-26203?

CVE-2026-26203 is a medium-severity vulnerability in Pjsip Pjmedia-Video, classified under Use After Free. CVSS score: 6.5/10. Published 2026-02-19.

How severe is CVE-2026-26203?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Use After Free in Pjsip Pjmedia-Video

CVE-2026-26203

PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing malformed H.264 bitstreams without NAL unit start codes, where the packetizer performs unchecked pointer arithmetic that can read from memory located before the allocated buffer. Version 2.17 contains a patch for the issue.

Vulnerability class: Use-After-Free

EPSS: 0.001 (1.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H.

Affected products

Pjsip Pjmedia-video — versions < 2.17
Pjsip

Weakness classification (CWE)

CWE-416 — Use After Free

References

security-advisories@github.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2026-26203?: CVE-2026-26203 is a medium-severity vulnerability in Pjsip Pjmedia-Video, classified under Use After Free. CVSS score: 6.5/10. Published 2026-02-19.
How severe is CVE-2026-26203?: Medium severity. CVSS v3 base score is 6.5 out of 10.