An attacker who can supply a crafted VP9 Scalability Structure (SS) packet to the PJSIP library can trigger a heap out‑of‑bounds read in the VP9 RTP unpacketizer. The vulnerability stems from insufficient bounds checking on the payload descriptor length, allowing the library to read past the end of the allocated RTP payload buffer and potentially expose data residing in neighboring memory. This type of error is reflected by CWE‑125.

The flaw is present in all releases of pjproject prior to version 2.17. Systems that depend on PJSIP for multimedia communication, such as VoIP gateways, SIP clients, or any application that processes VP9 RTP streams, are affected when they use an unpatched library and accept externally supplied VP9 packets. The patch was incorporated in the 2.17 release, so updating to that or a newer version removes the issue.

The CVSS score of 6.9 indicates a medium severity vulnerability. Because the flaw requires the victim to process a malicious VP9 packet, the attack is likely remote over the network. While no EPSS score is available and the issue is not listed in KEV, the moderate score combined with a potentially active network exposure suggests that the risk should be addressed promptly, especially on systems exposed to untrusted networks.