Pexip Infinity CVE-2026-103104

Exploitation requires network reachability to a Pexip Infinity node's media implementation and the ability to send crafted media input that fails input validation; no authentication (PR:N) and no user interaction (UI:N) are needed per the CVSS vector. Affected: Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0. The primary limiting factor is exposure - media-processing nodes reachable from an untrusted network are at risk, whereas deployments where media interfaces are restricted to trusted networks or fronted by session border controls materially reduce reachability. Impact is confined to availability (service abort/DoS); there is no data exposure or code execution.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated denial-of-service with no confidentiality or integrity impact - availability-only, which is consistent with CWE-617 (a reachable assertion / software abort in the media stack). All impact signals point the same direction and there is no internal contradiction in the data. However, the exploitation-likelihood signals are absent: no EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so exploitation status is 'no public exploit identified at time of analysis.' SSVC decision inputs were not supplied. The practical priority is moderate: an unauthenticated remote DoS against a real-time media platform is operationally meaningful (a triggered abort drops conferences), but with no exploitation evidence and no code integrity/confidentiality exposure, this is a service-availability patch rather than an emergency. The vendor security bulletin reference and explicit fixed versions (38.2, and later than 40.0) confirm a patch is available. Note the version range is unusual - fixed in 38.2 yet 39.0, 39.1 and 40.0 are re-affected - verify the correct upgrade target against the Pexip bulletin before patching.

A remote attacker with network reach to a Pexip Infinity Conferencing/Transcoding node sends crafted media traffic containing input that the media implementation fails to validate, triggering a software abort. The process aborts and the media service is denied to legitimate participants, dropping active conferences. No public exploit code is currently identified, and no authentication or user interaction is required per the CVSS vector.