EUVD-2026-89587
GHSA-4qcw-c3r4-gc9h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Conferencing Node over network
-
DeliverySend crafted malformed input
-
ExploitTrigger out-of-bounds write
-
ExecutionCorrupt memory / hijack control flow
-
ImpactExecute code as unprivileged user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of a Pexip Infinity Conferencing Node reachable over the network (CVSS AV:N/AC:L/PR:N/UI:N). The main factor LIMITING impact is that resulting code execution is as an UNPRIVILEGED user, not root, so full host compromise requires chaining a separate local privilege-escalation flaw (e.g. sibling CVE-2026-103106). Exposure is bounded by the niche deployment footprint and by whether the vulnerable Conferencing Node service is exposed to untrusted networks rather than an internal-only conferencing segment. |
| Impact | This is a genuine high-priority issue, not a CVSS-inflated one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst case: network-reachable, low-complexity, unauthenticated, no user interaction, with C:H/I:H/A:H yielding 9.8. The CWE-787 (out-of-bounds write) plus the 'Buffer Overflow' and 'Memory Corruption' tags corroborate the description's claim of remote code execution via improper input validation, so the classification is internally consistent. The one moderating factor the raw 9.8 hides is that code executes as an UNPRIVILEGED user (S:U, no scope change) on a Conferencing Node - not root - so it is a foothold rather than immediate full device takeover, and would typically be chained with a local privilege-escalation flaw such as sibling CVE-2026-103106 to reach root. Signals that would confirm urgency are absent: no EPSS score, no CISA KEV listing, and no public POC are present in the input. Per precision rules this is 'no public exploit identified at time of analysis' - the score reflects potential, not observed exploitation. This is the highest-severity member of a coordinated Pexip bulletin batch (103104 DoS, 103105 lateral RCE, 103106 privesc, 103109 media DoS), all fixed together, which lends credibility to the vendor's assessment even absent third-party POC data. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach a Pexip Infinity Conferencing Node over the network (e.g. a public-facing or federated conferencing endpoint) sends crafted input to a service that fails to validate it properly, triggering an out-of-bounds write. The memory corruption is shaped to hijack control flow, giving the attacker code execution as an unprivileged service user on the node. No public exploit code is identified at time of analysis, but the network-reachable, no-authentication, no-user-interaction profile makes this readily weaponizable if a POC emerges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated remote code execution in Pexip Infinity Conferencing Nodes (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) allows an attacker who can reach the node over the network to run arbitrary code as an unprivileged service account by sending crafted input that triggers an out-of-bounds write. Affected builds are all versions before 38.2 as well as 39.0, 39.1 and 40.0; a fixed 38.2 release and corresponding maintenance releases are referenced in Pexip's security bulletins. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), but exploitation requires no authentication, no user interaction and no special conditions, and the resulting code execution is unprivileged - full host takeover would require chaining a separate local privilege-escalation bug such as sibling CVE-2026-103106.
RemediationAI
Apply the vendor fix: upgrade Pexip Infinity to 38.2 or later, and for deployments on the 39.0, 39.1 or 40.0 release trains move to the corrected maintenance build specified in Pexip's security bulletin at https://docs.pexip.com/admin/security_bulletins.htm - Vendor-released patch: 38.2 (plus the corresponding fixed maintenance releases for the 39.x and 40.x branches as listed in that bulletin). Until upgrading is possible, the highest-value compensating control is to remove network reachability of the Conferencing Node's services from untrusted networks, placing them behind firewall rules or an access-controlled conferencing segment; the trade-off is that this breaks external conferencing, federation and remote-participant connectivity that depend on those endpoints, so it should be scoped to the specific exposed service ports. In addition, restrict the node's management interface to a dedicated administrative VLAN or jump host, deploy IDS/IPS signatures for malformed input against Pexip protocol handlers (detection, not prevention, and prone to false positives on complex media signalling), and monitor Conferencing Node hosts for unexpected child processes or dropped files originating from the service account - elevated process activity from that unprivileged account is the strongest available indicator of successful exploitation. Note that patching this CVE alone may not fully secure a host: because code execution is unprivileged, also remediate local privilege-escalation issues such as sibling CVE-2026-103106, otherwise an attacker who gains a foothold here can still escalate to root.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-787, out-of-bounds write, described by the vendor as improper input validation in Pexip Infinity's Conferencing Node software. This is a network-facing video-conferencing service that parses attacker-supplied protocol input, and the associated tags (Buffer Overflow, Memory Corruption) indicate that malformed input is written past the bounds of an allocated buffer, corrupting adjacent memory in a way that can be steered into remote code execution. The CPE entry cpe:2.3:a:pexip:infinity:*:*:*:*:*:*:*:* uses a wildcard version, confirming the vendor-level product is flagged broadly rather than a single build. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, the memory-corruption primitive is reachable pre-authentication on a default configuration, but code execution lands in the context of the unprivileged account running the Conferencing Node service rather than root - the key factor bounding real-world impact and the reason a second, local privilege-escalation vulnerability (for example CVE-2026-103106) would be needed to fully compromise the host.
Know when Infinity gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable OOB write (PR:N/AV:N/AC:L/UI:N) yielding code execution; S:U and C/I/A:H because execution is unprivileged on the node but fully compromises it.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node.
Executive ViewAI
Pexip Infinity Conferencing Nodes are exposed to a critical, unauthenticated remote code execution flaw (CVE-2026-103110) that allows anyone able to reach a node over the network to run arbitrary code on it. Because these nodes typically sit on signalling and conferencing networks reachable from partner, remote-work and sometimes internet-facing paths, the exposure extends beyond the video team: exploitation can disrupt meetings, expose meeting content and credentials, and provide a foothold for lateral movement into corporate networks. Leadership should treat this as a priority remediation item, starting with an immediate fleet inventory and a reduction of network exposure.
No vendor-released patch identified at time of analysis; Pexip security bulletins reference a fixed 38.2 release and corresponding maintenance releases, which should be confirmed directly with the vendor. Interim mitigations: restrict network access to Conferencing Nodes so only trusted signalling peers, management hosts and administrators can reach them, and eliminate internet-facing exposure; segment nodes from corporate networks using deny-by-default firewall rules and limit outbound egress; disable or restrict unused services and management interfaces; enable detailed logging and alerting for node crashes, service restarts and anomalous child processes running under the service account; monitor vendor advisories for the fixed 38.2 release, and remediate CVE-2026-103106 to prevent privilege-escalation chaining.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to byp
Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection
Navarino Infinity is prone to session fixation attacks. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading t
Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code. Rate
Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks. Rated
Improper input validation in Pexip Infinity's media implementation allows an unauthenticated remote party to send a craf
Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data expos
Improper access control in Pexip Infinity's product-internal, inter-node API lets an attacker who already holds a footho
Malformed signaling input delivered to Pexip Infinity deployments running versions before 41.0 can abort the signaling s
Local privilege escalation to root in Pexip Infinity (versions before 38.2, plus 39.0, 39.1, and 40.0) allows an attacke
Remote, unauthenticated denial of service in Pexip Infinity (all releases before 38.2, plus 39.0, 39.1, and 40.0) lets a
Exploit-DB