An out‑of‑bounds read can occur in the PJSIP library when it parses a VP9 scalability structure that has been specially crafted. The payload descriptor length is not properly checked, allowing the unpacketizer to read beyond the bounds of the allocated RTP payload buffer. This weakness is classified as CWE‑125 and may expose internal memory contents, leading to potential information disclosure.

The vulnerability affects the open‑source PJSIP multimedia communication library, known as pjproject. All releases prior to version 2.17 are impacted. Applications that incorporate any older build of pjproject and process VP9 streams are susceptible to this read error.

The CVSS v3.1 score of 6.9 indicates a moderate severity, while the EPSS figure of less than 1 % points to a low likelihood of exploitation. The issue does not appear in CISA’s KEV catalog. Based on the description, it is inferred that an attacker may trigger the read by sending crafted VP9 RTP packets to the vulnerable application, though no proven exploit exists at this time.