CVE-2026-26203

Name	CVE-2026-26203
Description	PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing malformed H.264 bitstreams without NAL unit start codes, where the packetizer performs unchecked pointer arithmetic that can read from memory located before the allocated buffer. Version 2.17 contains a patch for the issue.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1134884

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
asterisk (PTS)	bullseye	1:16.28.0~dfsg-0+deb11u4	vulnerable
	bullseye (security)	1:16.28.0~dfsg-0+deb11u9	vulnerable
	sid	1:22.9.0+dfsg+~cs6.16.60671434-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
asterisk	source	(unstable)	(unfixed)			1134884
pjproject	source	(unstable)	(unfixed)

Notes

https://github.com/pjsip/pjproject/security/advisories/GHSA-p965-mf7j-gwv8
Fixed by: https://github.com/pjsip/pjproject/commit/5aee54f09d4f91538d55279d7316591b28fded6c