Pexip Infinity CVE-2026-103099

Exploitation targets the media implementation of Pexip Infinity (versions before 41.1) and requires network reachability to that media plane; per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are needed against a reachable node. The concrete prerequisite is the ability to send crafted/malformed media input that reaches the improperly-validated code path and forces a software abort. Limiting factors: the impact is availability-only (a process/service crash, not code execution or data disclosure), and realistic exposure depends on whether the media services are reachable from untrusted networks versus restricted behind firewalls, session border controllers, or an established call context - the input does not specify whether an active media session must first be negotiated.

All exploitation signals point to a genuine but bounded availability threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remote, unauthenticated, low-complexity, no-interaction attack with pure availability impact and no scope change - fully consistent with CWE-617 (Reachable Assertion / software abort) causing a denial of service in Pexip Infinity's media implementation. There is no confidentiality or integrity exposure, so despite the 'High' rating this is a service-disruption issue, not an RCE or data-breach. No EPSS score, CISA KEV entry, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 7.5 is driven entirely by the A:H impact and easy reachability, not by observed weaponization. The MITRE-assigned record and the vendor's own security bulletins page are the only references, so version/fix data is vendor-anchored but exploit maturity is unproven. Net: a real, worth-patching availability priority for organizations exposing Pexip media services to untrusted networks, but not an emergency on the level of a remotely exploitable code-execution flaw.

A remote attacker with network reach to a Pexip Infinity node's media services sends malformed or unexpected media-plane input (e.g. crafted RTP/media negotiation traffic) that fails an internal validation check and triggers a software abort, crashing the affected process. Because no authentication or user interaction is required (PR:N/UI:N), repeated triggering can keep conferencing services offline. No public proof-of-concept was identified in the provided data.