PJSIP’s H.264 unpacketizer contains a heap‑based buffer overflow that occurs when it processes malformed SRTP packets. The unpacketizer reads a two‑byte NAL unit size field without confirming that the bytes lie within the packet payload, allowing an attacker to overflow the heap and potentially write arbitrary data, which can lead to denial of service or execution of malicious code. The weakness is identified as a buffer overflow (CWE‑120, CWE‑122).

The vulnerability is present in all releases of PJSIP pjproject version 2.16 and earlier. Any application that embeds pjproject and receives H.264 video over SRTP—such as VoIP or video conferencing software—is impacted. The affected vendor/product is PJSIP pjproject, with the specific bug fixed in releases newer than 2.16.

The CVSS score of 8.1 classifies this as high severity. However, the EPSS score of less than 1% indicates a very low likelihood of exploitation at present, and it is not listed in the CISA KEV catalog. The likely attack vector is remote network: an adversary could send crafted SRTP packets to a vulnerable application to trigger the overflow, potentially leading to remote code execution. Proper validation of packet bounds would prevent exploitation.