CVE-2026-77396: Out-of-bounds write in PJSIP AVI parser

Out-of-bounds write in PJSIP AVI parser via crafted files. CVSS 7,1 with no patch available yet.

CVE-2026-77396 affects the AVI parser of PJSIP library version 2.17 and earlier, an open source library widely used for multimedia communication. The vulnerability is located in pjmedia/src/pjmedia/avi_player.c, where the parser uses the video chunk length declared in the AVI file as the number of bytes to copy into a heap buffer. A crafted AVI file allows writing beyond memory allocation boundaries (out-of-bounds write), causing memory corruption and potential process compromise.

The vulnerability has a CVSS score of 7.1 (high), confirming significant severity. Currently, no patched version is available according to the NVD review of 2026-09-18. Disabling assertions in production builds eliminates the protection present in the code, exposing systems to concrete risk. A public signal on GitHub (observed 2026-10-31) indicates the availability of repositories that claim to contain exploits, signaling active interest from the research community in this flaw.

Defenders must first inventory applications using PJSIP, particularly those processing AVI files from untrusted sources. Implement access controls for multimedia streams, disable the AVI parser if not essential, and limit processing of suspicious AVI files. Monitor official PJSIP security announcements for a fix and in the meantime evaluate architectural mitigations such as sandboxing multimedia playback processes.

At a glance

What: Out-of-bounds write in the AVI parser of PJSIP library during file processing. The declared video chunk length is used directly as the number of bytes to copy into a heap buffer without validation against actual capacity. A crafted AVI file causes memory overflow and corruption of adjacent data.
Severity: CVSS 7.1 (high). The vulnerability enables memory corruption, denial of service via process crash, and potentially remote code execution in applications processing untrusted AVI files.
Affected versions: PJSIP 2.17 and earlier. The official description specifically covers version 2.17 and older versions. The status of later versions is not declared in the provided data.
Fix: Not available at the time of NVD review (2026-09-18). No patched version has been released according to the provided data.
Status: Public vulnerability recently disclosed (2026-09-18). Public GitHub repository declares the presence of exploit (observed 2026-10-31). PJSIP is an open source library widely used for multimedia communications.
Action: Inventory applications using PJSIP, especially those processing AVI from external sources. Disable the AVI parser if not essential. Restrict and control access to untrusted AVI files. Continuously monitor official PJSIP security updates and apply patches as soon as available.

Sources: NVD, CVE-2026-77396

← All articles