SB2026101470 - Multiple vulnerabilities in Janus WebRTC Server
Published: October 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Stack-based buffer overflow (CVE-ID: N/A)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a persistent denial of service.
The vulnerability exists due to a stack-based buffer overflow in the Record&Play plugin's recording header parsers when reading .mjr info headers using unchecked file-supplied lengths. A remote attacker can record a session with an excessively long video a=fmtp attribute in its SDP offer, producing a recording whose header exceeds the 1500-byte stack buffer, to cause a persistent denial of service.
The oversized header is parsed during playback and server startup. On hardened builds, runtime overflow checks abort the process; the recording and its index remain on disk and are parsed again on subsequent startups.
2) Heap-based buffer overflow (CVE-ID: N/A)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in the Record&Play plugin's playout thread when reading recorded frames using unchecked file-supplied lengths into a 1500-byte heap buffer. A remote attacker can trigger playback of a recording containing a frame length exceeding the buffer capacity to cause a denial of service.
3) Use-after-free (CVE-ID: N/A)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the SIP plugin's helper-registration code in src/plugins/janus_sip.c when processing helper registrations referencing a freed master session. A remote attacker can convert a master session into a helper, detach its handle, and register another helper using the stale master identifier to cause a denial of service.
The SIP plugin is loaded by default. Guest registration sends no SIP messages to external servers.
Remediation
Install update from vendor's website.