PJSIP pjproject versions 2.17 and earlier contain a heap-based buffer overflow in the AVI parser located in pjmedia/src/pjmedia/avi_player.c. The vulnerability arises because the parser uses the video chunk length from an input AVI file as the number of bytes copied into a frame buffer, whose size is based on declared media dimensions. Since production builds disable assertions that would otherwise check size constraints, a crafted AVI file can trigger an out-of-bounds write on the heap. This can lead to process crashes during local playback or more severe memory corruption when untrusted AVI sources are accepted by applications.

Exploitation of this vulnerability can cause application crashes or memory corruption, potentially leading to denial of service or other undefined behavior. The vulnerability requires local or user interaction (playing or processing a crafted AVI file). There are no known exploits in the wild. The CVSS 4.0 score is 6.9 (medium severity), reflecting the local attack vector and high impact on integrity and availability.

No official patch or fixed version is currently available. Users should avoid processing untrusted AVI files with affected versions of pjproject. Monitor vendor advisories for updates or patches. Since assertions are disabled in production builds, relying on them is not sufficient mitigation.