CVE-2026-26967: 
NixOS vulnerability analysis and mitigation

CVE-2026-26967 is a heap-based buffer overflow vulnerability in PJSIP's H.264 unpacketizer, affecting PJSIP versions 2.16 and below. The flaw was identified via fuzzing (fuzz-video fuzzer) and disclosed on February 20, 2026, with the GitHub Security Advisory (GHSA-x2hc-6969-g8v6) published on February 16, 2026. It affects all applications using PJSIP to receive H.264 video streams. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 8.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-120 (Buffer Copy without Checking Size of Input). In the pjmedia_h264_unpacketize function within pjmedia/src/pjmedia-codec/h264_packetizer.c, the unpacketizer reads a 2-byte NAL unit size field from the input buffer (q) without first verifying that both bytes fall within the payload buffer bounds (q + 2 > q_end). The fix, introduced in commit f821c21, adds the missing bounds check: changing if (p + pktz->cfg.unpack_nal_start > p_end) to if (p + pktz->cfg.unpack_nal_start > p_end || q + 2 > q_end). An unauthenticated remote attacker can trigger this by sending a specially crafted malformed SRTP video packet to a vulnerable application (GitHub Commit, GitHub Advisory).

Successful exploitation of this vulnerability can result in arbitrary code execution, memory read operations, data modification, or denial of service against any application that processes H.264 video using PJSIP 2.16 or below. Because no authentication or user interaction is required and the attack vector is network-accessible, the attack surface is broad — encompassing VoIP clients, video conferencing systems, and communication platforms built on PJSIP. The CVSS v4.0 scoring reflects high impacts on confidentiality, integrity, and availability of the vulnerable component (GitHub Advisory, Red Hat Bugzilla).

There is currently no public proof-of-concept exploit code and no evidence of in-the-wild exploitation. The vulnerability was discovered through fuzzing (credited to researcher arthurscchan) rather than active threat actor activity. The EPSS score is approximately 0.014% (0.000140), indicating a low current probability of exploitation in the wild. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploit maturity is rated as "Unreported" in CVSS v4.0 scoring (GitHub Advisory, Feedly).

1. Reconnaissance: Identify applications using PJSIP versions 2.16 or below that accept H.264 video streams over SRTP (e.g., VoIP/video conferencing endpoints). Tools like Shodan or SIP scanning utilities can help identify exposed SIP/SRTP services.
2. Establish media session: Initiate or intercept an SRTP video session with the target application. Depending on the deployment, this may require sending a SIP INVITE to establish a call that negotiates H.264 video.
3. Craft malformed SRTP packet: Construct a malformed SRTP video packet where the RTP payload contains an H.264 STAP-A or FU-A NAL unit with a 2-byte NAL unit size field that extends beyond the actual payload buffer boundary.
4. Trigger buffer overflow: Send the crafted packet to the target. The vulnerable pjmedia_h264_unpacketize function reads the 2-byte NAL size field without validating q + 2 > q_end, causing an out-of-bounds heap read or write.
5. Achieve objective: Depending on heap layout and memory state, the overflow may result in a crash (DoS), information disclosure from adjacent heap memory, or — with additional heap grooming — arbitrary code execution in the context of the PJSIP application process (GitHub Commit, GitHub Advisory).

• Network: Unexpected or malformed SRTP/RTP video packets with anomalous payload sizes targeting SIP/media ports (typically UDP 5004, 5060, or dynamically negotiated RTP ports); unusual volume of video stream packets from unknown sources.
• Logs: Application crash logs or core dumps originating from pjmedia_h264_unpacketize or h264_packetizer.c; SIP stack error logs indicating invalid media packet processing.
• Process: Unexpected termination or restart of PJSIP-based applications (e.g., Asterisk, FreeSWITCH, or custom VoIP clients); abnormal child processes spawned by the media processing service.
• File System: Core dump files generated by the PJSIP application process in the working directory or /var/crash/; heap sanitizer (ASan/Valgrind) reports referencing h264_packetizer.c line ~452.

The primary remediation is to upgrade PJSIP to version 2.17 or later, which includes the patch commit f821c21 that adds the missing bounds check on the NAL unit size field. If immediate upgrading is not feasible, restrict network access to video processing services using vulnerable PJSIP versions — for example, by firewall rules limiting SRTP/RTP traffic to trusted sources only. Additionally, monitor for anomalous video stream processing activity and consider disabling H.264 video reception if it is not required by the application (GitHub Commit, GitHub Advisory).

Red Hat has tracked this vulnerability via Bugzilla (Bug 2441242) and classified it as high severity, with the product security team assigned to response. The vulnerability was credited to researcher arthurscchan, who discovered it through fuzzing. Coverage has appeared on security aggregation sites including CVEFeed, VulnDB, and INCIBE-CERT, though no major independent security researcher commentary or significant social media discussion has been identified at this time (Red Hat Bugzilla, GitHub Advisory).