Read the docs
TI-2026-65594 Aliases CVE-2026-103106GHSA-4mpf-j2w4-fh8h

Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input…

Priority LOW 35CWE-669Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service that allows an attacker with local access to escalate privileges to root. Exploitation requires an attacker to be able to run arbitrary code on a node by either achieving remote code execution via some other vulnerability or having administrative access to the operating system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00141 3rd percentileScored 2026-11-07
Fix Fixed Infinity (Pexip): 38.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PexipInfinitybefore 38.2.0; 39.0.0; 39.1.0; 40.0.038.2.0Patch availableCNA
  • Infinity VendorPexip Affected before 38.2.0; 39.0.0; 39.1.0; 40.0.0 Fixed in 38.2.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*before 38.2; 39.0 – 39.1VulnerablePexip
cpe:2.3:a:pexip:pexip_infinity:40.0:*:*:*:*:*:*:*40.0VulnerablePexip
  • cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:* Versions before 38.2; 39.0 – 39.1 Vulnerable ·Pexip
  • cpe:2.3:a:pexip:pexip_infinity:40.0:*:*:*:*:*:*:* Versions 40.0 Vulnerable ·Pexip

Remediation

  • Fix · CNA Infinity (Pexip) Fixed in 38.2.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Pexip Infinity 38.2.0

    6 records Highest priority Priority MEDIUM 2 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-65597 Out-of-bounds write in Pexip InfinityPriority MEDIUM 50
    • TI-2026-65596 Out-of-bounds write in Pexip InfinityPriority MEDIUM 40
    • TI-2026-65595 Reachable assertion in Pexip InfinityPriority LOW 39
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-103106
  2. 2026-10-03 Alias added: GHSA-4mpf-j2w4-fh8h

References

Advisory 1

  • TI-2026-65597 Out-of-bounds write in Pexip Infinity CVSS 3.1CRITICAL 9.8
  • TI-2017-04328 Pexip Infinity before 14.2 allows remote attackers to cause a denial of service (service… CVSS 3.0CRITICAL 9.8
  • TI-2025-37146 Incorrect authorization in Pexip Infinity CVSS 3.1CRITICAL 9.1
  • TI-2020-09479 Pexip Reverse Proxy and TURN Server before 6.1.0 has Incorrect UDP Access Control via TURN. CVSS 3.1CRITICAL 9.8
  • TI-2015-03944 The client API authentication mechanism in Pexip Infinity before 10 allows remote… CVSS 3.1CRITICAL 9.8
  • TI-2026-65591 Resource allocation without limits in Pexip Infinity CVSS 3.1HIGH 8.6
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences