EUVD-2026-89585
GHSA-584g-7p7q-99pg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Pexip media service over network
-
DeliverySend crafted media stream
-
ExploitTrigger improper input validation (CWE-787)
-
ExecutionCause controlled abort / memory corruption
-
ImpactDenial of service on conferencing node
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to Pexip Infinity's media implementation (the media/RTP processing path of a conferencing node) and the ability to deliver a crafted media stream that is processed by the vulnerable node. Per the input CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication or user interaction is required, so any party able to establish or inject a media stream to an exposed node can attempt it. Limiting factors: the attacker must be able to route a malicious media stream to the service (deployments that restrict media reachability to trusted peers or place nodes behind controlled signaling/edge components reduce exposure), and affected versions are bounded to Infinity before 38.2 and the 39.0, 39.1, and 40.0 releases - patched/other versions are not affected. The confirmed impact is a denial of service (controlled abort); memory corruption is a stated potential, not a demonstrated outcome. |
| Impact | Signals are largely consistent and point to a serious-but-not-emergency issue. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, and a 9.4 base score is driven by the I:H/A:H impact metrics. However, every exploitation-maturity signal is low: EPSS is only 0.24% (14th percentile), SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial, there is no CISA KEV listing, and no public exploit was identified. This is the classic high-CVSS/low-current-real-risk profile - the theoretical reach is broad but there is no evidence of active exploitation or weaponization. One point of tension worth verifying: the primary described outcome is a denial of service via 'controlled abort,' with memory corruption described only as a 'potential,' yet the input vector assigns I:H and C:L; the confirmed impact is availability loss, while the integrity/confidentiality impact is speculative and not substantiated by the description. SSVC Technical Impact=partial aligns better with a DoS-dominant outcome than with full code execution. Treat as a patch-soon priority (a vendor patch is available) rather than a drop-everything emergency. |
| Exploit ScenarioDerived | A remote attacker who can reach the Pexip Infinity media services sends a crafted media stream to a conferencing node. Improper input validation during media processing causes a controlled software abort (denial of service), degrading or dropping conferencing availability, with the described potential to corrupt memory. No public exploit code was identified, and no special privileges or user interaction are required per the input CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 05, 2026
Improper input validation in Pexip Infinity's media implementation allows an unauthenticated remote party to send a crafted media stream that causes memory corruption or a controlled software abort on the conferencing node, resulting in denial of service. Affected releases are Infinity before 38.2 and the 39.0, 39.1, and 40.0 branches; because the published vector is network-reachable with no privileges (PR:N) and no user interaction (UI:N), any host able to route media to an exposed node can attempt exploitation, though CISA's SSVC assessment rates the issue as not automatable, indicating a hand-crafted rather than commodity attack. The confirmed outcome is a controlled abort (availability impact), with memory corruption explicitly a stated potential rather than demonstrated, and the published 9.4 score is moderated in independent assessment (C:N/I:L/A:H) since confidentiality impact is not established; there is no public exploit identified at time of analysis and EPSS is low at 0.24% (14th percentile).
Earlier versions of this analysis (1)
Remote, unauthenticated attackers can cause denial of service or potentially memory corruption in Pexip Infinity media processing by delivering a crafted media stream to affected versions (before 38.2, plus 39.0, 39.1, and 40.0). Exploitation requires high attack complexity to construct the stream that triggers a controlled abort, and the vendor describes memory corruption as a potential outcome; no public exploit identified at time of analysis.
RemediationAI
Pexip has released a fix, and the primary action is to upgrade the affected node to Infinity 38.2 or later on the 38.x train, or to the corresponding corrected build in the 39.x/40.x line; consult the vendor security bulletins at https://docs.pexip.com/admin/security_bulletins.htm for the exact fixed release for your train, since the advisory lists 39.0, 39.1, and 40.0 as affected rather than naming a 39.x/40.x fix version. Because this is a media-path flaw reachable without authentication, patching should be prioritized for any conferencing node whose media ports are reachable from untrusted networks, and staged maintenance windows should be planned since upgrading a conferencing node disrupts active conferences. Where immediate patching is not possible, compensating controls are network-level and should be applied with awareness of their cost: restrict RTP/media reachability to known peer addresses, trusted SIP trunks, or session border controllers with strict media/ICE policies, and front exposed nodes with a signaling/media proxy that normalizes streams - this reduces the attack surface but will break direct peer-to-peer or federated media from legitimate external participants and requires careful ACL maintenance. Segmenting conferencing nodes from general corporate networks and monitoring for abnormal node restarts or core dumps provides detective coverage for attempted aborts, though it will not prevent memory corruption. There is no vendor-released patch identified outside the fixed 38.2 line as described above, and no public workaround that eliminates the flaw at the application layer.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pexip Infinity is a software-based video conferencing and interoperability platform whose conferencing nodes terminate signaling and process real-time media (RTP) streams between participants, including transcoding and media manipulation on the node itself. The vulnerability lives in that media-processing path, where the node fails to adequately validate the structure or length of fields derived from an attacker-supplied media stream. The CWE classification is CWE-787 (out-of-bounds write), so the root cause is a write past the bounds of an allocated buffer while parsing or transforming media data - a class of bug that classically yields either an immediate crash/abort or arbitrary memory corruption depending on the attacker's control over adjacent memory. The published vector (AV:N/AC:L/PR:N/UI:N) places the attack surface directly on the media listener, meaning an attacker does not need a signaling account or a legitimate conference invitation, only the ability to deliver a stream that the node will decode and process; SSVC 'Automatable: no' and 'Technical Impact: partial' temper this by suggesting the crafted stream must be tailored and that the realized effect in observed cases is service disruption rather than reliable code execution. The affected CPE (cpe:2.3:a:pexip:infinity) covers the Infinity product line, with exposure bounded to releases before 38.2 and the 39.0, 39.1, and 40.0 trains.
Know when Infinity gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Network-reachable media processing with no auth/UI gives AV:N/AC:L/PR:N/UI:N; confirmed impact is DoS (A:H), with memory corruption only 'potential' so I:L and C:N.
Primary rating from Vendor (mitre).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a denial of service. A crafted media stream may result in a controlled abort during processing, and has the potential to achieve memory corruption.
Executive ViewAI
A critical input-validation flaw in Pexip Infinity's media handling allows any unauthenticated party who can route media to an exposed conferencing node to crash it, disrupting video conferencing for the organization. Because the attack requires only network reachability and no credentials or user interaction, every internet- or partner-facing Infinity deployment running a release before 38.2 or on the 39.0, 39.1, or 40.0 branches is a candidate target, although the hand-crafted nature of the attack and low exploit-prediction score suggest limited mass-exploitation risk today. A vendor patch is available, so leadership should treat this as a time-sensitive remediation item rather than an active incident.
Apply vendor patch. Until upgrades complete, restrict media traffic to trusted peer networks and monitor conferencing nodes for unexpected service restarts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Pexip Infinity DoS, Access Control, and Memory Flaws
View all 9In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to byp
Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection
Navarino Infinity is prone to session fixation attacks. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading t
Unauthenticated remote code execution in Pexip Infinity Conferencing Nodes (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) allows an att
Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code. Rate
Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks. Rated
Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data expos
Exploit-DB