CVE-2026-77396

Name of the Vulnerable Software and Affected Versions PJSIP versions prior to 2.18

Description The AVI parser in pjmedia/src/pjmedia/avi player.c uses a video chunk length from an input file to determine the number of bytes copied into a frame buffer. Because the buffer capacity is based on declared media dimensions, a specially crafted AVI file can trigger an out-of-bounds write past the heap allocation during file playback or frame extraction. This occurs because size assertions are disabled in production release builds, potentially leading to process crashes or memory corruption in applications that process untrusted AVI sources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.