Pexip vulnerabilities
We track 22 vulnerabilities in Pexip products across 2 products. 22 are rated high or critical, and none are known to be exploited. The most recent was published on September 30, 2026.
Latest Pexip vulnerabilities
- 9.8 Critical severity
Infinity: Out-of-bounds Write
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node.
- 9.4 Critical severity
Infinity: Out-of-bounds Write
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a denial of service. A crafted media stream m
- 7.5 High severity
Infinity: Reachable Assertion
Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service
- 7.8 High severity
Infinity: Incorrect Resource Transfer Between Spheres
Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service that allows an attacker with local access to escalate privileges to root. Exploitation requires an attacker to be able to
- 8.8 High severity
Infinity: Incorrect Authorization
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local access to a node within a Pexip Infinity installation to execute arbitrary code as an unprivileged user o
- 7.5 High severity
Infinity: Reachable Assertion
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a remote attacker to trigger a software abort resulting in a denial of service.
- 8.6 High severity
Infinity: Allocation of Resources Without Limits or Throttling
Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to trigger a software abort resulting in a denial of service. Exploitation of this issue requires accessing a gateway call from a
- 7.5 High severity
Infinity: Allocation of Resources Without Limits or Throttling
Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible.
- 7.5 High severity
Infinity: Reachable Assertion
Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trigger a software abort resulting in a denial of service.
- 7.5 High severity
Infinity: Reachable Assertion
Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service.
- 7.5 High severity
Infinity: Reachable Assertion
Pexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a remote attacker to trigger a software abort via a crafted media stream, resulting in a denial of service.
- 7.5 High severity
Infinity: Incorrect Authorization
Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an attacker to disconnect RTMP streams traversing a Proxy Node.
- 7.5 High severity
Infinity: Missing Authentication for Critical Functionality
Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an attacker (who already has access to execute code on one node within a Pexip Infinity installation) to impact the operation of other nodes withi
- 9.1 Critical severity
Infinity: Incorrect Authorization
Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy Exchange Tokens. This allows a remote attacker to read potentially sensitive data and excessively consume re
- 7.5 High severity
Infinity: Reachable Assertion
Pexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a denial of service.
- 7.5 High severity
Infinity: Reachable Assertion
Pexip Infinity 33.0 through 37.0 before 37.1 has improper input validation in signaling that allows an attacker to trigger a software abort, resulting in a denial of service.
- 7.5 High severity
Infinity: Reachable Assertion
Pexip Infinity before 37.0 has improper input validation in signalling that allows a remote attacker to trigger a software abort via a crafted signalling message, resulting in a denial of service.
- 7.5 High severity
Signalling in Pexip Infinity 29 through 36.2 before 37.0 has improper input validation that…
Signalling in Pexip Infinity 29 through 36.2 before 37.0 has improper input validation that allows remote attackers to trigger a temporary denial of service (software abort).
- 7.5 High severity
Pexip Infinity before 35.0 has improper input validation that allows remote attackers to…
Pexip Infinity before 35.0 has improper input validation that allows remote attackers to trigger a denial of service (software abort) via a crafted signalling message.
- 7.5 High severity
Pexip Infinity: Allocation of Resources Without Limits or Throttling
Pexip Infinity 27 before 28.0 allows remote attackers to trigger excessive resource consumption and termination because of registrar resource mishandling.
- 7.5 High severity
Pexip Infinity 27.x before 27.3 has Improper Input Validation.
Pexip Infinity 27.x before 27.3 has Improper Input Validation. The client API allows remote attackers to trigger a software abort via a gateway call into Teams.
- 7.5 High severity
Pexip Infinity: Allocation of Resources Without Limits or Throttling
Pexip Infinity before 27.0 has improper WebRTC input validation. An unauthenticated remote attacker can use excessive resources, temporarily causing denial of service.