Out-of-bounds write in Janus WebRTC Server - #VU151863
Published: September 23, 2026
Vulnerability identifier: #VU151863
CSH Severity: Low
CVSS v4: 7.5 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-787
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code or cause a denial of service.
The vulnerability exists due to an integer truncation resulting in a heap-based buffer overflow in janus_string_replace() in src/utils.c when processing SDP trickle candidates after mDNS or DNS resolution. A remote user can send a crafted trickle candidate containing an oversized candidate string to execute arbitrary code or cause a denial of service.
Exploitation depends on the transport accepting a candidate message larger than 64 KB and on the attacker answering the mDNS or DNS resolution.
Affected software
Janus WebRTC Server
Remediation
Install security update from vendor's website.
Janus WebRTC Server - addressed in versions 0.16.2, 1.4.2