CVE-2026-34235: 
NixOS vulnerability analysis and mitigation

CVE-2026-34235 is a heap out-of-bounds read vulnerability in PJSIP's VP9 RTP unpacketizer, affecting all versions of PJSIP prior to 2.17. The flaw occurs when parsing crafted VP9 Scalability Structure (SS) data, where insufficient bounds checking on the payload descriptor length may cause reads beyond the allocated RTP payload buffer. It was published on March 31, 2026, and patched in PJSIP version 2.17. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-125 (Out-of-bounds Read), located in the pjmedia_vpx_unpacketize function within pjmedia/src/pjmedia-codec/vpx_packetizer.c. When parsing the VP9 Scalability Structure (SS), the code increments desc_len by N_S * 4 when the Y-bit is set, but fails to verify that the resulting desc_len remains within the bounds of the received RTP payload buffer before continuing to read from it. The fix, applied in commit f4c7d08, adds a bounds check immediately after the desc_len increment, returning PJ_ETOOSMALL if the length exceeds the payload. Exploitation requires no authentication or user interaction and is reachable over the network by any peer capable of sending VP9 RTP packets to an affected PJSIP application with video support enabled (PJMEDIA_HAS_VIDEO) (GitHub Advisory, Patch Commit).

Successful exploitation can result in information disclosure by reading sensitive data from heap memory beyond the intended buffer, as well as denial of service through application crashes. Any PJSIP application with video support enabled that receives VP9 RTP media is potentially affected, including VoIP clients, conferencing systems, and communication platforms built on PJSIP. There is no integrity impact, but the combination of high confidentiality and high availability impact (per CVSS v3.1) makes this a significant risk for deployments handling sensitive communications (GitHub Advisory, Red Hat).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The attack is network-accessible, requires no privileges or user interaction, and targets any PJSIP application with VP9 video support enabled, which lowers the bar for potential future exploitation (GitHub Advisory).

1. Reconnaissance: Identify targets running PJSIP-based applications (e.g., VoIP clients, SIP servers, conferencing software) with video support enabled and VP9 codec active, using network scanning or SIP enumeration tools.
2. Establish media session: Initiate or intercept a VP9 RTP media session with the target PJSIP application, either as a legitimate caller or via a man-in-the-middle position on the network.
3. Craft malicious VP9 RTP packet: Construct a VP9 RTP packet with a malformed Scalability Structure (SS) payload descriptor where the Y-bit is set and N_S is set to a value that causes desc_len + N_S * 4 to exceed the actual payload buffer length.
4. Send crafted packet: Transmit the malicious RTP packet to the target. The unpacketizer reads beyond the allocated buffer, potentially leaking heap memory contents or triggering a crash.
5. Achieve objective: Analyze leaked memory for sensitive data (e.g., keys, credentials, session data) or leverage the crash for denial of service (GitHub Advisory, Patch Commit).

• Network: Unexpected or malformed VP9 RTP packets with anomalous payload descriptor lengths received by PJSIP-based applications; unusual RTP traffic from unknown or untrusted sources targeting SIP/media ports.
• Logs: Application crash logs or core dumps originating from pjmedia_vpx_unpacketize or related VP9 unpacketizer code paths; repeated PJ_ETOOSMALL or memory access error entries in PJSIP logs.
• Process: Unexpected termination or restart of PJSIP-based processes (e.g., Asterisk, Linphone, or custom SIP applications) coinciding with receipt of VP9 RTP media streams.

Upgrade PJSIP to version 2.17 or later, which includes the bounds check fix applied in commit f4c7d08. As an immediate workaround for deployments that cannot upgrade, disable the VP9 codec if it is not required by the application, which eliminates the vulnerable code path entirely. Administrators should also consider restricting RTP media reception to trusted sources via firewall rules or SIP access controls to reduce exposure (GitHub Advisory, Patch Commit).

Red Hat has acknowledged the vulnerability and published a tracking page for CVE-2026-34235. Tenable has released a Nessus detection plugin (ID 304784) for the vulnerability. No significant public researcher commentary or social media discussion has been observed beyond standard vulnerability database aggregation (Red Hat, Tenable).