CVE-2026-103109 is a high severity (CVSS 7.7) improper input validation flaw in the media handling of Pexip Infinity, affecting versions before 38.2 plus 39.0, 39.1 and 40.0. A crafted media stream can abort processing and may corrupt memory. Pexip's bulletin lists fixed versions 38.2, 39.2, 40.1 and 41.0.
What's affected
Per the record, Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected. Pexip's bulletin gives the resolution as an upgrade to v41, v40.1, v39.2 or v38.2. Check the bulletin for the exact release that matches your line.
The same bulletin lists a separate critical issue, CVE-2026-103110, for remote code execution as an unprivileged user on a Conferencing Node, with the same upgrade guidance. Plan a single upgrade for both.
How to check if you're exposed
Check the version in the Pexip Infinity administrator interface, on the Management Node and on every Conferencing Node. If you run Pexip in a cloud or in several data centres, list every deployment, since nodes can sit on different releases during a staged upgrade.
If you are on 38.0 or 38.1, 39.0 or 39.1, or 40.0, you are in range.
What to do now
- Upgrade to v41, v40.1, v39.2 or v38.2, whichever matches your release line.
- Upgrade the Management Node first, then the Conferencing Nodes, following Pexip's upgrade guide.
- If an upgrade has to wait, contact your Pexip authorized support representative about mitigation options. The bulletin points there.
- Also act on CVE-2026-103110, listed in the same bulletin.
- Check the Pexip security bulletins page for new entries each time you review.
Why it matters
The record describes improper input validation in the media implementation, filed as CWE-787 (out-of-bounds write). A crafted media stream may trigger a controlled abort, which is a denial of service, and the bulletin says it has the potential to achieve memory corruption.
Video conferencing systems accept media from many parties, which makes the media path a natural target. That is why the attack vector in the record is network based, though the complexity is rated high.
The record does not report exploitation in the wild, and the KEV flag is false. Pexip credits and describes issues on its bulletin page, which is the source to follow for updates.
Quick check
Does this need a login to the conferencing system?
The vector lists no privileges and no user interaction, with high attack complexity. Read the Pexip bulletin for details of the media path that applies to you.
Sources
Last reviewed: 19 October 2026.
