PJSIP CVE-2026-77396

Q: What is the CVSS score of CVE-2026-77396?

CVE-2026-77396 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-83196 MEDIUM

Heap-based Buffer Overflow (CWE-122)

2026-09-18 GitHub_M

Buffer Overflow Heap Overflow Pjsip Pjproject

6.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Attacker-supplied AVI must be played locally (AV:L, UI:R); no auth needed (PR:N); heap corruption gives I:H/A:H with no disclosure (C:N).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Sep 18, 2026 - 17:56 vuln.today

CVE Published

Sep 18, 2026 - 17:07 cve.org

MEDIUM 6.9

DescriptionCVE.org

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/avi_player.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media dimensions. A crafted AVI file can therefore cause an attacker-controlled out-of-bounds write past the heap allocation when an application plays the file or pulls its frames. The existing size assertion does not protect production release builds, where assertions are disabled. Typical local playback can crash the process, while applications that accept untrusted AVI sources expose a stronger memory-corruption condition. No fixed version is available as of this review.

AnalysisAI

Heap-based out-of-bounds write in the PJSIP pjmedia AVI player (pjproject 2.17 and earlier) lets a crafted AVI file overwrite memory beyond a frame buffer when an application plays the file or pulls its frames. The buffer capacity is derived from the video dimensions declared in the file, while the copy length is taken from the file's own chunk header, so a malicious header produces an attacker-controlled write; the protection that would normally catch this is a pj_assert() that is compiled out of production release builds. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires the victim application to load and play (or pull frames from) an attacker-supplied AVI file via PJSIP's pjmedia AVI player - exploitation is local and file-driven, gated by passive user interaction (UI:P), not remote-unauthenticated. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a real but bounded issue rather than an internet-facing emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch version has been confirmed as of this review, so the recommended action is to backport upstream commit 7ecc6584969a923c4190b6912afbf5952b5a4b9f (https://github.com/pjsip/pjproject/commit/7ecc6584969a923c4190b6912afbf5952b5a4b9f) into your pjproject tree; the change clamps the read length to frame->size before copying into the frame buffer and seeks past any unread chunk bytes to preserve file alignment, and it removes reliance on pj_assert, which is compiled out of release builds. … Detailed patch versions, workarounds, and compensating controls in full report.