EUVD-2026-89584
GHSA-2xqf-gx7w-hfc7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Pexip media service
-
DeliverySend malformed media input
-
ExploitFail input validation check
-
ExecutionTrigger software abort (assertion)
-
ImpactProcess crash denies conferencing
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Exploitation requires network reachability to the media implementation of a Pexip Infinity node running an affected version (before 38.2, or 39.0, 39.1, 40.0). Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no non-default configuration are required - a remote attacker able to send media-plane traffic to the node can trigger the software abort. The primary limiting factor is exposure scope: the attacker must be able to reach the vulnerable media service (typically the Conferencing Node handling call media), so nodes segmented behind firewalls or restricted to trusted media peers face reduced risk. Impact is limited to availability (service crash); no data disclosure or code execution results. |
| Impact | CVSS 3.1 base score is 7.5 (High) driven entirely by availability impact (A:H) with no confidentiality or integrity loss. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates a fully remote, network-reachable, low-complexity, unauthenticated, no-user-interaction condition - meaning it is easy to trigger against exposed nodes. However, this is a pure denial-of-service (reachable assertion / software abort, CWE-617), not a code-execution or data-exposure flaw, so the real-world impact ceiling is service disruption rather than compromise. EPSS score is not provided, the CVE is NOT in CISA KEV, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data is supplied. Net assessment: this is a genuine but bounded availability priority - the low attack barrier makes it easy to abuse, yet the absence of KEV/POC and the availability-only impact place it below the RCE-class flaws in the same Pexip bulletin (cf. sibling CVE-2026-103105 lateral RCE). Treat as a patch-soon issue for internet-facing conferencing nodes rather than an emergency. |
| Exploit ScenarioDerived | An attacker who can reach a Pexip Infinity node's media services over the network sends malformed media-plane input that fails an internal validation check, tripping a reachable assertion / software abort. The affected process crashes, dropping active conferences and denying service to legitimate users. No authentication or user interaction is required (PR:N/UI:N), and no public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Remote, unauthenticated denial of service in Pexip Infinity (all releases before 38.2, plus 39.0, 39.1, and 40.0) lets an attacker who can reach a node's media service send crafted input that triggers a software abort and crashes the affected process. The vulnerability carries a CVSS 3.1 base score of 7.5 (High), driven entirely by availability impact (A:H) with no confidentiality or integrity loss, and requires only network reachability to the media-plane service - no credentials, no user interaction, and no non-default configuration. There is no CISA KEV listing and no public exploit code identified at time of analysis, so the practical risk is concentrated in internet-facing or broadly reachable Conferencing Nodes, while nodes segmented behind firewalls or restricted to trusted media peers face reduced exposure.
RemediationAI
Apply the vendor fix: Pexip Infinity 38.2 is the release identified as addressing the 38.x line, and organizations running 39.0, 39.1, or 40.0 should consult the corresponding fixed maintenance releases listed on the vendor security bulletins page at https://docs.pexip.com/admin/security_bulletins.htm before upgrading, since a single version number does not cover all three affected trains. Where patching cannot be scheduled immediately, the most effective compensating control is reducing exposure of the media service: restrict network reachability to the Conferencing Node's media ports so that only trusted media peers, SIP proxies, or session border controllers can send traffic to it, and block unfiltered inbound media-plane traffic from the internet - the trade-off is that this also prevents external participants and federated or guest endpoints from connecting directly, and any permissive rule exception reintroduces the crash vector. Segmenting Conferencing Nodes into a dedicated media VLAN behind a firewall and monitoring for unexpected process restarts, watchdog-triggered failovers, or abrupt call-drops provides detection while the patch is pending, though it does not stop an attacker who already has reachability. Because no public exploit code has been identified, the priority is exposure reduction rather than emergency mitigation, but nodes with broad media reachability should be treated as high priority given the 7.5 base score and the complete absence of authentication or user-interaction barriers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pexip Infinity is a distributed enterprise video-conferencing platform in which Conferencing Nodes process call signaling and media; the flaw lies in the media implementation, the subsystem that ingests and handles call media streams. CWE-617 (Reachable Assertion) is the assigned root-cause class: improper input validation allows malformed or unexpected media input to reach a point in the code where the implementation aborts, terminating the process rather than handling the input gracefully. This is a classic availability-only failure mode - the abort produces a service crash, not memory corruption, data disclosure, or code execution. The CPE record cpe:2.3:a:pexip:infinity:*:*:*:*:*:*:*:* designates the affected product as Pexip Infinity with an open-ended version wildcard, consistent with the advisory's enumeration of affected releases (before 38.2, plus 39.0, 39.1, and 40.0). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms the attack is network-deliverable with low complexity and no privileges or interaction required, and the scope is unchanged. Because exploitation depends on reaching the media service specifically, network placement of the Conferencing Node - not the attacker's privileges - is the decisive control.
Know when Infinity gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated media input trivially triggers a software abort (AV:N/AC:L/PR:N/UI:N); impact is availability-only crash with no confidentiality or integrity loss and no scope change.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service
Executive ViewAI
Pexip Infinity deployments running any release before 38.2, as well as 39.0, 39.1, and 40.0, are exposed to a remote, unauthenticated denial-of-service condition in the media-plane service that can crash the affected process and disrupt conferencing availability. Because no patch is currently available and exploitation requires nothing more than network reachability to the media service, organizations exposing Conferencing Nodes to the internet or to broad internal networks carry the greatest operational risk. Leadership should care because a successful attack degrades a business-critical collaboration platform, potentially interrupting executive communications, customer-facing meetings, and regulated service delivery.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability to the media service using firewalls and ACLs so only trusted media peers can connect; segment Conferencing Nodes away from general internal and internet exposure; monitor for process aborts, crash loops, and media service restarts; engage Pexip support for interim guidance and upgrade to 38.2 or later as soon as a fix is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Pexip Infinity DoS, Access Control, and Memory Flaws
View all 9In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to byp
Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection
Navarino Infinity is prone to session fixation attacks. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading t
Unauthenticated remote code execution in Pexip Infinity Conferencing Nodes (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) allows an att
Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code. Rate
Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks. Rated
Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data expos
Exploit-DB