Division by zero in pjsip - #VU156284
Published: October 21, 2026
Vulnerability identifier: #VU156284
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-369
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by crashing the application.
The vulnerability exists due to division by zero in the video conference bridge when five or more video sources are connected to one sink and sources receive empty destination rectangles that are subsequently used as divisors. A remote attacker can supply video as a connected conference participant under this condition to trigger division by zero and cause an application crash.
Affected software
pjsip
Remediation
Install security update from vendor's website.
pjsip - update to 2.18