Pexip Infinity CVE-2026-103100

Exploitation requires network reachability to the Pexip Infinity signaling implementation (typically a Conferencing Node's call-signaling endpoint) on a version before 40.1; no authentication and no user interaction are needed per AV:N/PR:N/UI:N, and the attacker only needs to send a malformed signaling message that fails input validation. The primary limiting factor is exposure of the signaling interface: deployments where signaling is restricted to trusted/internal networks or fronted by a hardened reverse proxy substantially reduce reachable attack surface, and impact is confined to availability (service crash/dropped calls) with automatic restart likely limiting duration.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a cleanly remotely reachable, unauthenticated, low-complexity flaw whose entire impact is availability - no confidentiality or integrity loss. CWE-617 (reachable assertion / software abort) is consistent with the description: crafted signaling input trips an assertion or fatal error path that terminates the process rather than corrupting memory, so this is a denial-of-service issue, not a code-execution primitive. No EPSS score, no CISA KEV listing, and no public exploit are present in the supplied data, and there is no SSVC decision record; exploitation status is therefore 'no public exploit identified at time of analysis.' The high base score is driven almost entirely by the A:H availability metric combined with the easy network reachability, so this is a genuine but bounded priority: it can knock a conferencing node offline but cannot be leveraged for data theft or persistence. Real-world urgency is elevated for internet-facing signaling endpoints and lower for internally segmented deployments. Because only a single vendor-bulletin reference is provided, the specific signaling protocol and exact trigger are not independently confirmed here.

An attacker who can reach a Pexip Infinity node's signaling interface (e.g. an internet-facing Conferencing Node) sends a malformed signaling message that fails input validation and triggers a software abort. The affected service process crashes, dropping active calls and preventing new conferences until it restarts. No public exploit code is identified, and no authentication or user interaction is required per the CVSS vector.