CVE and update status of the FreeBSD ports tree3,296 unaddressed CVEs in 671 portsAll times are CET
CVE details

CVE-2026-77396

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/avi_player.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media dimensions. A crafted AVI file can therefore cause an attacker-controlled out-of-bounds write past the heap allocation when an application plays the file or pulls its frames. The existing size assertion does not protect production release builds, where assertions are disabled. Typical local playback can crash the process, while applications that accept untrusted AVI sources expose a stronger memory-corruption condition. No fixed version is available as of this review.

Score
6.9 medium
Published
2026-09-18
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
net/pjsippjsip2.14.1unaddressedoliver.epper@gmail.com

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>pjsip</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>PJSIP is a free and open source multimedia communication library
	written in C. In 2.17 and earlier, the PJSIP AVI parser in
	pjmedia/src/pjmedia/avi_player.c uses an input-file video chunk length
	as the number of bytes copied into a frame buffer whose capacity is
	derived from the declared media dimensions. A crafted AVI file can
	therefore cause an attacker-controlled out-of-bounds write past the
	heap allocation when an application plays the file or pulls its
	frames. The existing size assertion does not protect production
	release builds, where assertions are disabled. Typical local playback
	can crash the process, while applications that accept untrusted AVI
	sources expose a stronger memory-corruption condition. No fixed
	version is available as of this review.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-77396</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-77396</url>
    </references>
    <dates>
      <discovery>2026-09-18</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>