Patch Forecast
Amber warning
Patch this week.

CVE-2026-103109

Pexip Infinity: out-of-bounds write can lead to denial of service

Risk score
65/100
CVSS
9.4 v3.1
Exploit chance (30 days)
0.3%
Published
30 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a denial of service. A crafted media stream may result in a controlled abort during processing, and has …
Affected
Pexip Infinity before 38.2
Fix
Upgrade Pexip Infinity to 38.2 or later.
Exploitation
No known exploitation

Story map

Story map: Pexip InfinityTHE FLAWSTHE FIXCVE-2026-103109Out-of-bounds write can leadto denial of serviceCVSS 9.4 · EPSS 0%CVE-2026-103110Out-of-bounds writeCVSS 9.8 · EPSS 1%CVE-2026-103102Denial of serviceCVSS 8.6 · EPSS 0%CVE-2026-103099Denial of serviceCVSS 7.5 · EPSS 0%Upgrade Pexip Infinity38.2 · 41.0 · 41.1or later on your release lineWho is exposedPexip Infinity before 38.2AMBER · PATCH THIS WEEKPexip InfinityPexip Infinity before 38.2, plus39.0, 39.1 and 40.0, is affectedby improper input validation thatallows a remote attacker toexecute code remotely as anunprivileged user on a PexipInfinity Conferencing Node.Where it standsNo known exploitationCONNECTS TOSame weaknessOut-of-bounds write (CWE-787)257 other warnings in 30 days →Same productEarlier Pexip Infinity warnings6 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Pexip Infinity: Amber, patch this week. Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node.

The flaws

The fix

Upgrade Pexip Infinity: 38.2 · 41.0 · 41.1 or later on your release line

Who is exposed: Pexip Infinity before 38.2

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 9.4 critical
  • Remotely exploitable without logging in

References

Original description

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a denial of service. A crafted media stream may result in a controlled abort during processing, and has the potential to achieve memory corruption.

Last activity 30 Sep 2026. Patch Forecast updates every hour.