CVE-2026-103109

{
  "etk_id": "ETK-2026-77",
  "cve_id": "CVE-2026-103109",
  "display_id": "CVE-2026-103109",
  "ghsa_id": "GHSA-584g-7p7q-99pg",
  "euvd_id": "EUVD-2026-89585",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper media-stream validation in Pexip Infinity",
  "summary": "Pexip Infinity media processing is affected in releases before 38.2 and in 39.0, 39.1, and 40.0. A remote attacker able to have a crafted media stream processed may cause an abort and denial of service, with possible memory corruption.",
  "mitigation": "Update the Infinity package to version 38.2.0, the fixed release identified in the structured advisory data. Until updates are applied, limit processing of media streams from untrusted remote sources where operationally feasible.",
  "vendor": "Pexip",
  "product": "Infinity",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 38.2.0",
        "39.0.0",
        "39.1.0",
        "40.0.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "38.2.0"
      ],
      "package_name": "Infinity",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H",
  "epss_score": 0.0025,
  "epss_percentile": 0.1583,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 29.378281566666665,
  "t0_at": "2026-09-30T02:59:53.499000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-09-30T02:59:53.499000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T02:59:53.499000+00:00",
      "url": "https://github.com/advisories/GHSA-584g-7p7q-99pg"
    }
  }
}