The vulnerability in Pexip Infinity arises from improper input validation that permits a remote attacker to execute arbitrary code as an unprivileged user. This flaw is a classic buffer overflow (CWE-787), giving an attacker the ability to alter the program’s execution flow and run code with the node’s privileges. The impact is code execution on the Conferencing Node without privileged escalation, potentially exposing VoIP traffic or enabling further lateral movement within the network.

Products affected are Pexip Infinity versions prior to 38.2 and versions 39.0, 39.1, and 40.0. Users operating these releases on a Conferencing Node should assume the vulnerability is present. The vulnerability does not affect other Pexip components or later releases that are not listed.

The CVSS score of 9.8 labels this as critical. EPSS information is not available, but the absence of a CISA KEV listing does not diminish the severity. The attack requires remote access to the node’s API or interface that processes input; the attacker does not need privileged credentials. Given the high severity and lack of mitigation, a malicious actor could exploit this flaw to compromise the node promptly.