CVE-2025-66379: 
Pexip Infinity Management Node vulnerability analysis and mitigation

CVE-2025-66379 is an Improper Input Validation vulnerability in the media implementation of Pexip Infinity, a video conferencing platform. It allows a remote, unauthenticated attacker to trigger a software abort by sending a crafted media stream, resulting in a denial of service. All versions of Pexip Infinity before 39.0 are affected. The vulnerability was published on December 25, 2025, and carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, Pexip Security Bulletins).

The root cause is classified as CWE-617 (Reachable Assertion), meaning the media processing code contains an assertion that can be triggered by attacker-controlled input, causing the process to abort abnormally. An unauthenticated remote attacker can exploit this by sending a specially crafted media stream to a vulnerable Pexip Infinity node over the network, requiring no privileges or user interaction. The flaw resides specifically in the media implementation layer, suggesting the malformed stream violates an internal invariant assumed by the media processing logic. No public proof-of-concept code has been identified at this time (Red Hat CVE, Pexip Security Bulletins).

Successful exploitation causes a software abort in the Pexip Infinity media processing component, resulting in a denial of service condition that disrupts video and audio communication services. There is no impact on confidentiality or integrity — the vulnerability is limited to availability. Organizations relying on Pexip Infinity for critical communications (e.g., enterprise video conferencing, healthcare telehealth) could experience significant service interruptions if targeted (Red Hat CVE).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit as of the time of reporting. The vulnerability requires no authentication, no privileges, and no user interaction, making it trivially accessible to any network-reachable attacker. The EPSS score is approximately 0.139%, indicating a low current probability of exploitation in the wild. CVE-2025-66379 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE, CISA Bulletin).

• Network: Unexpected or malformed media streams (e.g., RTP/RTCP packets with anomalous structure) directed at Pexip Infinity media ports from untrusted or unknown source IPs.
• Logs: Repeated software abort or crash log entries in Pexip Infinity system logs, particularly those referencing the media processing component; unexpected process restarts of media-handling services.
• Process: Abnormal termination or restart of Pexip Infinity media processing processes correlated with inbound media session attempts from external sources.

Pexip has released version 39.0 of Pexip Infinity, which addresses this vulnerability. Organizations should upgrade all Pexip Infinity deployments to version 39.0 or later as the primary remediation. As a temporary workaround prior to patching, network-level controls (e.g., firewall rules, ACLs) should be implemented to restrict media stream access to trusted sources only. Monitoring for unexpected software aborts or service interruptions can help detect exploitation attempts (Pexip Security Bulletins).

The vulnerability received brief coverage on social media platforms including Mastodon and Bluesky, primarily from security news aggregators such as TheHackerWire. The CISA weekly vulnerability bulletin for the week of December 22, 2025 referenced CVE-2025-66379, indicating it was noted by U.S. government cybersecurity authorities. No significant vendor statements beyond the Pexip security bulletin or notable independent researcher commentary have been identified (CISA Bulletin).