The PJSIP multimedia library contains a component called pjmedia‑video, whose H.264 packetizer has a heap buffer underflow vulnerability. When the packetizer processes fragmented NAL units that do not contain start code delimiters, it performs unchecked pointer arithmetic and can read memory located before the beginning of its allocated buffer. This memory read can expose sensitive data from the heap, although the description does not indicate that it directly leads to code execution or other higher‑level impacts.

Versions of the PJSIP library older than 2.17 are affected. The flaw resides in the pjmedia‑video component of the PJSIP project. The issue was addressed in release 2.17, which adds validation of H.264 streams and corrects the pointer arithmetic in the packetizer.

With a CVSS score of 5.1, the vulnerability is considered medium severity. The EPSS score is below 1 %, indicating a low likelihood of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. The likely attack vector, inferred from the nature of the library, is remote via a network stream; an attacker could transmit specially crafted H.264 packets to a system that uses the vulnerable pjmedia‑video component to trigger the underflow.