Pexip Infinity DoS, Access Control, and Memory Flaws

Improper input validation in Pexip Infinity's media implementation allows an unauthenticated remote party to send a crafted media stream that causes memory corruption or a controlled software abort on the conferencing node, resulting in denial of service. Affected releases are Infinity before 38.2 and the 39.0, 39.1, and 40.0 branches; because the published vector is network-reachable with no privileges (PR:N) and no user interaction (UI:N), any host able to route media to an exposed node can attempt exploitation, though CISA's SSVC assessment rates the issue as not automatable, indicating a hand-crafted rather than commodity attack. The confirmed outcome is a controlled abort (availability impact), with memory corruption explicitly a stated potential rather than demonstrated, and the published 9.4 score is moderated in independent assessment (C:N/I:L/A:H) since confidentiality impact is not established; there is no public exploit identified at time of analysis and EPSS is low at 0.24% (14th percentile).

Improper access control in Pexip Infinity's product-internal, inter-node API lets an attacker who already holds a foothold on one node of a multi-node deployment execute arbitrary code as an unprivileged user on another node. The affected builds are Infinity before 38.2 as well as 39.0, 39.1 and 40.0, tracked as CPE cpe:2.3:a:pexip:infinity:*:*:*:*:*:*:*:* and rooted in CWE-863 (incorrect authorization). The internal API requires no authentication (PR:N) and no user interaction (UI:N), but the attack path is adjacent-network only (AV:A) and code runs unprivileged on the target rather than as root; there is no public exploit identified at time of analysis and no CISA KEV listing, though the 8.8 CVSS and lateral-movement potential make this a high-priority fix for any clustered installation.

Malformed signaling input delivered to Pexip Infinity deployments running versions before 41.0 can abort the signaling software, denying conferencing service to users of the affected node. The issue is network-reachable and carries a CVSS 3.1 base of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), with the severity driven almost entirely by the high availability impact plus the scope-change component rather than by any loss of confidentiality or integrity. The CVSS vector's PR:N indicates no privilege requirement, but exploitation still carries an access precondition: the attacker must be able to reach the WebRTC/API signaling entry point and participate in a gateway call, so internet-facing nodes that permit open WebRTC/API gateway calling are directly at risk while internal-only or call-restricted deployments are substantially less exposed. There is no public exploit identified at time of analysis, and the fixed release (Pexip Infinity 41.0) is available.

Local privilege escalation to root in Pexip Infinity (versions before 38.2, plus 39.0, 39.1, and 40.0) allows an attacker who already holds a foothold on a node to break out of a low-privileged local context and obtain full root control. Per the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), the flaw is local-only, requires low privileges, and is not remotely exploitable on its own: the attacker must first run arbitrary code on the node, either by chaining a separate remote code execution vulnerability or by already possessing administrative access to the node's operating system. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); the practical risk is that this bug turns any successful initial compromise of a Pexip Infinity host into a complete root compromise, so it should be treated as a meaningful post-exploitation escalation rather than a standalone remote threat.

Remote, unauthenticated denial of service in Pexip Infinity (all releases before 38.2, plus 39.0, 39.1, and 40.0) lets an attacker who can reach a node's media service send crafted input that triggers a software abort and crashes the affected process. The vulnerability carries a CVSS 3.1 base score of 7.5 (High), driven entirely by availability impact (A:H) with no confidentiality or integrity loss, and requires only network reachability to the media-plane service - no credentials, no user interaction, and no non-default configuration. There is no CISA KEV listing and no public exploit code identified at time of analysis, so the practical risk is concentrated in internet-facing or broadly reachable Conferencing Nodes, while nodes segmented behind firewalls or restricted to trusted media peers face reduced exposure.

Malformed media-plane input to Pexip Infinity before 41.1 can trigger an assertion failure and abort the media process, causing a denial of service. The flaw is remotely reachable without authentication or user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, availability-only impact), though practical exposure depends on whether the media services are reachable from untrusted networks. No public exploit code or confirmed active exploitation was identified at the time of analysis.

Unauthenticated remote attackers can abort the media process in Pexip Infinity, causing a denial of service on conferencing nodes that are reachable from an untrusted network. The root cause is improper input validation in the media implementation (CWE-617, a reachable assertion/software abort): crafted media input drives the software into an unrecoverable abort rather than failing gracefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms this is availability-only - no confidentiality or integrity impact and no code execution - and affected releases are Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0. No public exploit code and no confirmed active exploitation were identified at time of analysis; the practical exposure driver is whether media-processing interfaces are directly reachable, since deployments that restrict media to trusted networks or front it with session border controls materially reduce reachability.

Denial of service in Pexip Infinity 30.0 through 40.x allows unauthenticated remote attackers to render a node inaccessible by sending input that the web server fails to validate properly (CWE-770). The flaw is network-reachable and low-complexity with no authentication (PR:N) or user interaction (UI:N) required, and its sole impact is availability - there is no confidentiality or integrity loss - with CVSS 3.1 scored 8.6. No public exploit code and no confirmed active exploitation were identified at time of analysis; risk is concentrated in deployments whose management or conferencing web interface is exposed to untrusted networks.

Unauthenticated remote attackers can cause a denial of service against Pexip Infinity conferencing deployments by sending malformed signaling messages that trigger a software abort. The vulnerability, tracked as CVE-2026-103100, affects all versions before 40.1 and stems from improper input validation (CWE-617). No public exploit identified at time of analysis, but the flaw is remotely reachable with low complexity and high availability impact, making prompt patching critical for internet-exposed signaling interfaces.