CVE-2022-24786

PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.

• CWE-125
• CWE-787
• CWE-125
• CWE-787

• https://github.com/pjsip/pjproject/commit/11559e49e65bdf00922ad5ae28913ec6a198d508Patch, Third Party Advisory
• https://github.com/pjsip/pjproject/security/advisories/GHSA-vhxv-phmx-g52qThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/11/msg00021.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202210-37Third Party Advisory
• https://www.debian.org/security/2022/dsa-5285Third Party Advisory
• https://github.com/pjsip/pjproject/commit/11559e49e65bdf00922ad5ae28913ec6a198d508Patch, Third Party Advisory
• https://github.com/pjsip/pjproject/security/advisories/GHSA-vhxv-phmx-g52qThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/11/msg00021.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202210-37Third Party Advisory
• https://www.debian.org/security/2022/dsa-5285Third Party Advisory

Published

Apr 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24780Combodo iTop is a web based IT Service Management tool. In v…8.8
• CVE-2022-24781Geon is a board game based on solving questions about the Py…7.1
• CVE-2022-24782Discourse is an open source discussion platform. Versions 2.…4.3
• CVE-2022-24783Deno is a runtime for JavaScript and TypeScript. The version…10
• CVE-2022-24784Statamic is a Laravel and Git powered CMS. Before versions 3…3.7
• CVE-2022-24785Moment.js is a JavaScript date library for parsing, validati…7.5
• CVE-2022-24787Vyper is a Pythonic Smart Contract Language for the Ethereum…7.5
• CVE-2022-24788Vyper is a pythonic Smart Contract Language for the ethereum…9.8
• CVE-2022-24789C1 CMS is an open-source, .NET based Content Management Syst…7.6
• CVE-2022-2479Insufficient validation of untrusted input in File in Google…4.3
• CVE-2022-24790Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 se…7.5
• CVE-2022-24791Wasmtime is a standalone JIT-style runtime for WebAssembly, …9.8