CVE-2026-26967: Pjsip H.264 Buffer Overflow Vulnerability

CVE-2026-26967 Overview

CVE-2026-26967 is a critical Heap-based Buffer Overflow vulnerability affecting PJSIP, a free and open source multimedia communication library written in C. The vulnerability exists in PJSIP's H.264 unpacketizer component and occurs when processing malformed SRTP packets. The unpacketizer incorrectly reads a 2-byte NAL unit size field without validating that both bytes are within the payload buffer bounds, leading to potential memory corruption.

This vulnerability affects all applications that receive video using H.264 through PJSIP versions 2.16 and below. Given the widespread use of PJSIP in VoIP applications, video conferencing systems, and SIP-based communication platforms, this vulnerability poses a significant risk to enterprise communications infrastructure.

Critical Impact

Remote attackers can send specially crafted SRTP packets to trigger a heap-based buffer overflow, potentially leading to remote code execution or denial of service in applications using PJSIP for H.264 video communication.

Affected Products

• PJSIP versions 2.16 and below
• Applications using PJSIP's H.264 video codec functionality
• VoIP and video conferencing systems built on PJSIP

Discovery Timeline

• 2026-02-20 - CVE-2026-26967 published to NVD
• 2026-02-20 - Last updated in NVD database

Technical Details for CVE-2026-26967

Vulnerability Analysis

The vulnerability resides in the H.264 packetizer module (h264_packetizer.c) within PJSIP's media codec handling. When processing incoming SRTP packets containing H.264 video data, the unpacketizer parses NAL (Network Abstraction Layer) units to reconstruct video frames. The core issue stems from insufficient boundary validation when reading the 2-byte NAL unit size field from the payload buffer.

In the vulnerable code path, the unpacketizer iterates through the payload buffer to extract NAL units. While it performs some boundary checks against the payload end pointer (p_end), it fails to verify that the destination buffer (q) has sufficient space for the 2-byte read operation before accessing the NAL unit size. This allows an attacker to craft a malicious SRTP packet that causes the unpacketizer to read beyond allocated buffer boundaries.

Root Cause

The root cause is a missing boundary check in the H.264 unpacketizer's packet processing loop. The original code verified that the source pointer plus the NAL start code length didn't exceed the payload end, but neglected to validate that the destination buffer had at least 2 bytes available for the NAL unit size field read operation. This is classified as CWE-122 (Heap-based Buffer Overflow).

Attack Vector

The attack can be executed remotely over the network without any authentication or user interaction. An attacker would need to:

1. Target an application using PJSIP with H.264 video enabled
2. Establish or inject into an RTP/SRTP session
3. Send malformed SRTP packets with crafted NAL unit structures
4. Trigger the buffer overflow during H.264 frame reconstruction

The network-based attack vector makes this particularly dangerous for internet-facing VoIP and video conferencing applications.

         while (q < q_end && p < p_end) {
             pj_uint16_t tmp_nal_size;
 
-            if (p + pktz->cfg.unpack_nal_start > p_end)
+            if (p + pktz->cfg.unpack_nal_start > p_end || q + 2 > q_end)
                 return PJ_EINVAL;
 
             /* Write NAL unit start code */

Source: GitHub Commit

The patch adds an additional boundary check (q + 2 > q_end) to ensure the destination buffer has sufficient space before reading the 2-byte NAL unit size field, preventing the heap overflow condition.

Detection Methods for CVE-2026-26967

Indicators of Compromise

• Unexpected crashes or segmentation faults in PJSIP-based applications during video calls
• Anomalous SRTP packets with malformed H.264 NAL unit structures
• Memory corruption errors in application logs related to h264_packetizer.c
• Unusual heap allocation patterns during RTP session handling

Detection Strategies

• Deploy network intrusion detection signatures for malformed H.264 NAL unit packets in RTP/SRTP streams
• Monitor application crash dumps for stack traces involving h264_packetizer.c or NAL unit processing functions
• Implement deep packet inspection for RTP payloads with invalid NAL unit size fields
• Use memory sanitizers (ASan, MSan) during development and testing to detect heap overflows

Monitoring Recommendations

• Enable verbose logging for PJSIP media codec operations to capture packet processing errors
• Monitor for repeated PJ_EINVAL return codes from H.264 unpacketizer functions
• Set up alerts for application restarts or crashes during active video sessions
• Track RTP session statistics for abnormal packet rejection rates

How to Mitigate CVE-2026-26967

Immediate Actions Required

• Update PJSIP to the latest patched version that includes commit f821c214e52b11bae11e4cd3c7f0864538fb5491
• Review all applications using PJSIP for H.264 video functionality and prioritize patching
• Consider temporarily disabling H.264 video codec support if patching is not immediately feasible
• Implement network-level filtering to block suspicious RTP/SRTP traffic from untrusted sources

Patch Information

A security patch is available from the PJSIP project. The fix is contained in commit f821c214e52b11bae11e4cd3c7f0864538fb5491 which adds proper boundary validation before reading NAL unit size fields. Organizations should apply this patch by updating to a PJSIP version that includes this fix.

For detailed information about the vulnerability and patch, refer to:

• GitHub Security Advisory GHSA-x2hc-6969-g8v6
• GitHub Commit with Fix

Workarounds

• Disable H.264 video codec in PJSIP configuration and use alternative codecs (VP8, VP9) until patching is complete
• Restrict video functionality to trusted network segments only
• Deploy web application firewalls or network security appliances capable of inspecting RTP payload structures
• Implement strict input validation at the application layer before passing data to PJSIP

# Configuration example - Disable H.264 codec in PJSIP
# In pjsip configuration, remove or comment out H.264 codec registration
# Example for pjsua2 applications:
# accountConfig.videoConfig.enabled = false
# Or disable specific codec:
# pjsua_vid_codec_set_priority("H264", 0)