CVE-2026-34235 is a heap out-of-bounds read in the VP9 RTP unpacketizer of PJSIP, the open source multimedia library. NVD scores it 9.1, while the project rates it moderate. Upgrade to PJSIP 2.17 or later, or disable the VP9 codec if you do not need it.
What's affected
The project's advisory (GHSA-pqrm-53pc-wx28) lists PJSIP 2.16 and lower as affected and 2.17 as patched. The fix is commit f4c7d08 on the master branch.
The flaw is triggered by crafted VP9 Scalability Structure data in an RTP stream. The payload descriptor length is not checked enough, so the parser can read beyond the allocated buffer.
PJSIP is embedded in many apps and VoIP stacks, including as a bundled library. You may be using it without having chosen it.
How to check if you're exposed
If you build PJSIP yourself, check the version in your build or the PJ_VERSION string your app reports. For distribution packages, check the package version or the vendor advisory.
Then check whether VP9 is enabled. Applications that only do audio, or that never register the VP9 codec, are not exposed through this path, which is the advisory's workaround.
What to do now
- Find the applications and images that bundle PJSIP.
- Upgrade to 2.17 or later, or apply your vendor's patched build.
- If you cannot upgrade soon, disable the VP9 codec in your configuration.
- Rebuild and redeploy anything that bundles PJSIP statically.
Why it matters
The weakness is CWE-125, an out-of-bounds read. Parsing code trusted a length field from the network and read past the end of the packet buffer, which can expose memory contents or crash the process.
The score and the project's rating differ. NVD lists 9.1, with high confidentiality and availability impact. The project calls it moderate. Use the higher number for planning if the app handles calls from the internet. The record does not mark this as exploited and it is not on the CISA KEV list.
Quick check
Is disabling VP9 enough?
The advisory names it as a workaround, but the fix is version 2.17.
Sources
Last reviewed: 19 October 2026.
