CVE-2026-103110

Executive Summary

CVE-2026-103110 is a critical improper input validation vulnerability (CWE-787, out-of-bounds write) in Pexip Infinity Conferencing Node affecting versions before 38.2, plus 39.0, 39.1, and 40.0. A remote, unauthenticated attacker can exploit the flaw to execute code as an unprivileged user on an exposed Conferencing Node, yielding a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Impact is full compromise of confidentiality, integrity, and availability on the targeted node; no EPSS score has been published by FIRST.org, no CISA KEV listing exists, and no public PoC or exploit code is currently available.

Technical Analysis

CVE-2026-103110 is an improper input validation weakness mapped to CWE-787 (Out-of-bounds Write). According to the NVD description, the vulnerability resides in Pexip Infinity Conferencing Node and "allows a remote attacker to execute code remotely as an unprivileged user" on that node.

The mechanics, at the vulnerability-class level, are as follows:

• Root cause class: An out-of-bounds write arises when a program writes data past the end (or before the beginning) of an allocated buffer. This typically occurs when externally supplied input is not validated against the size, format, or bounds of the destination memory region before a copy or parse routine processes it.
• Attack surface: The Pexip Infinity Conferencing Node is a network-facing service. Because the CVSS vector carries AV:N (Network) with PR:N (no privileges) and UI:N (no user interaction), the vulnerable input-processing path is reachable over the network without authentication and without any victim interceding. The precise network protocol, port, endpoint, or parameter that carries the malicious input is not disclosed in the NVD description or CNA title, and is therefore not stated here.
• Memory-corruption consequence: An out-of-bounds write can overwrite adjacent memory (heap or stack depending on allocation). Where the write is attacker-influenced in content and offset, an attacker can corrupt control data or adjacent structures and redirect execution. This aligns with the high Confidentiality/Integrity/Availability subscores.
• Privilege outcome: The NVD description specifies execution as an unprivileged user, not root/system. This constrains post-exploitation to the privileges of the compromised service process, but such a foothold is still sufficient for data theft, lateral movement, and, in many deployment models, container or host breakout depending on hardening.

No public PoC, nuclei template, or exploit code was available in the tracked sources at the time of writing. No specific function names, file paths, endpoints, or parameters are provided in the source data, and none are fabricated here. The precise triggering input is therefore insufficient technical detail available beyond the improper-input-validation / out-of-bounds-write class.

Exploitation Scenarios

The following attack chain is inferred strictly from the vulnerability class (improper input validation leading to out-of-bounds write) and the CVSS characteristics. No public PoC is available.

1. Reconnaissance / target identification. An adversary enumerates internet-exposed Pexip Infinity Conferencing Nodes. Because the vulnerability is network-reachable and pre-authentication, discovered conferencing nodes (web management interfaces, signaling, or media-processing surfaces) are candidate targets. Asset discovery can be performed via internet-scanning services or targeted scanning of known corporate video-conferencing ranges. The exact exposed service is not disclosed in the source data.

2. Triggering the flaw class. The attacker sends a crafted network request that reaches the input-parsing path for the affected Conferencing Node. Because input validation is improper, a malformed or oversized field is accepted and passed to a routine that writes it into a fixed-size memory buffer, producing an out-of-bounds write. The specific field, protocol, and message format are not published; the general mechanism is that the unvalidated input exceeds the bounds the handler expects.

3. Payload / execution method (class-level). By carefully shaping the input to influence what is written and where, the attacker corrupts adjacent memory. On a successful out-of-bounds write, this can redirect execution to attacker-chosen data. The NVD description states the result is code execution as an unprivileged user on the Conferencing Node. No shellcode specifics, offsets, or function names are disclosed and none are invented.

4. Post-exploitation impact. With arbitrary code execution as an unprivileged service user, an attacker can read and tamper with data processed by the node (high C/I), disrupt conferencing service (high A), pivot to internal corporate networks reachable from the node, and persist. Because the foothold is unprivileged, escalation to higher privilege would depend on additional local vulnerabilities or misconfigurations outside the scope of this CVE.

Note: No public PoC available; attack chain is inferred from the vulnerability class (improper input validation / out-of-bounds write) and the CVSS descriptor.

Impact Assessment

• CVSS v3.1 base: 9.8 (Critical). Vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • AV:N — the vulnerable surface is remotely reachable; exposure is a function of how the Conferencing Node is published to untrusted networks.
  • AC:L / PR:N / UI:N — no special conditions, credentials, or user interaction reported, maximizing exploitability when reachable.
  • S:U — impact is scoped to the vulnerable component, but a Conferencing Node frequently bridges into corporate infrastructure.
  • C:H/I:H/A:H — full compromise of confidentiality (access to conferencing media, configuration, credentials), integrity (arbitrary code, configuration manipulation), and availability (node crash or takeover).
• Affected systems: Deployments running Pexip Infinity Conferencing Node on versions before 38.2, and on 39.0, 39.1, and 40.0 per the NVD description. Exact version boundaries beyond those literally stated are not provided.
• Blast radius: A single compromised node can affect all conferences routed through it, may expose connected management tiers, and may serve as a pivot into internal networks. Because the node handles real-time media and signaling, integrity attacks carry confidentiality risk for meeting content and credentials.
• No KEV / no EPSS: CISA KEV does not list this CVE and FIRST.org has no EPSS score at the time of writing — exploitation in the wild is not officially confirmed. This does not reduce severity given the pre-auth RCE nature.

Detection Guidance

The following detections are generic-to-the-class (unauthenticated malformed input reaching a network-facing conferencing service, and subsequent process behavior). They are not signature matches for a specific disclosed parameter.

Sigma Rule

title: Potential CVE-2026-103110 Pexip Infinity Node Anomalous Process Activity
id: 7c1b0f2e-0000-4000-9000-pexip103110
status: experimental
description: Detects suspicious child processes spawned by the Pexip Infinity Conferencing Node service, consistent with remote code execution as an unprivileged user.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103110
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/pexip'
      - '/pexip-infinity'
      - '/conferencing-node'
  selection_susp:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_susp
falsepositives:
  - Legitimate maintenance scripts executed by node services
level: high

YARA Rule

rule CVE_2026_103110_Pexip_Infinity_Input_Validation
{
    meta:
        description = "Detects anomalous artifacts associated with CVE-2026-103110 Pexip Infinity improper input validation / out-of-bounds write exploitation attempts"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103110"
        cve = "CVE-2026-103110"
        author = "Threat Intelligence"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $pexip1 = "Pexip Infinity" ascii nocase
        $pexip2 = "Conferencing Node" ascii nocase
        $crash1 = "AddressSanitizer: heap-buffer-overflow" ascii
        $crash2 = "AddressSanitizer: stack-buffer-overflow" ascii
        $crash3 = "*** buffer overflow detected ***" ascii

    condition:
        (2 of ($pexip1, $pexip2)) and 1 of ($crash1, $crash2, $crash3)
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-103110 Pexip Infinity Conferencing Node anomalous oversized request (possible OOB write)"; flow:to_server,established; content:"Pexip"; http_header; nocase; byte_test:1,>,4096,0,relative; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-103110; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-103110; sid:2026103110; rev:1;)

Note: No specific endpoint, parameter, or protocol is disclosed in the source data; this rule heuristically flags oversized input to a Pexip-identifying service and should be tuned to environment-specific ports and normal request profiling.

Elastic Detection

sequence by process.parent.entity_id with maxspan=10s
  [process where process.parent.name : ("pexip", "pexip-infinity", "conferencing-node")]
  [process where process.name : ("sh", "bash", "dash", "curl", "wget", "nc", "python3") and
     event.category : "process" and event.type : "start"]

Interpretation: flags a shell or download utility spawned by the Pexip node process tree, indicative of post-exploitation code execution stemming from CVE-2026-103110.

Splunk SPL Query

index=network OR index=proxy OR index=firewall
| search (http_user_agent="*Pexip*" OR url="*pexip*")
| eval req_size=len(_raw)
| where req_size > 4096
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, dest_port, url
| where count > 5
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="pexip,cve-2026-103110,">
  <rule id="100310" level="12">
    <if_sid>5501</if_sid>
    <field name="parent_process">pexip|pexip-infinity|conferencing-node</field>
    <field name="command">sh|bash|curl|wget|nc</field>
    <description>CVE-2026-103110: Suspicious child process spawned by Pexip Infinity Conferencing Node (possible RCE)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>exploit_attempt,</group>
  </rule>
</group>

Note: Rules reference the process-execution audit stream; ensure the parent-process and command fields are mapped to your ossec/wazuh decoder for the node service.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Per the NVD description, the vendor states the issue is addressed in version 38.2 and in the remediated branches 39.0, 39.1, and 40.0. No vendor advisory, release-note URL, or commit was present in the tracked patch sources, so Patch confidence remains 0/4 and the status should be treated as unconfirmed until validated against Pexip's official advisory.

1) Immediate mitigations (until patch is confirmed/deployed):

• Remove Conferencing Nodes from direct internet exposure where operationally possible; restrict access behind VPN, Zero Trust proxies, or strict allowlists.
• Enforce network segmentation and least-privilege firewall rules so only trusted conferencing/SIP/media peers can reach the node.
• Rate-limit and inspect inbound requests to node services; deploy the Suricata/WAF heuristics above to flag oversized or malformed input.
• Enable verbose node/log retention and forward to the SIEM; monitor for anomalies per the process-based detections.
• Run nodes as a dedicated low-privilege account (defense-in-depth; the CVE already yields unprivileged RCE, but containment limits blast radius).

2) Patch/upgrade steps:

• Validate the fix against Pexip's official advisory and release notes. The NVD description indicates 38.2 plus remediated 39.x/40.0 branches — confirm target fixed versions before rollout.
• Test in a staging environment, then upgrade affected nodes on a maintenance window.
• Re-scan after upgrade to confirm the node no longer reports the affected version range.

3) Long-term hardening:

• Maintain an asset inventory of all conference nodes and their exposure.
• Adopt a patch cadence for internet-facing conferencing infrastructure aligned to critical severity.
• Harden the node OS/container (immutable images, read-only filesystems where possible), enforce memory-safety mitigations (ASLR, heap/stack protections), and monitor for crash anomalies that may indicate in-the-wild exploitation attempts.
• Track the CVE for KEV/EPSS updates as new exploitation evidence emerges.

References

1. NVD — CVE-2026-103110: https://nvd.nist.gov/vuln/detail/CVE-2026-103110
2. MITRE CWE-787 — Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
3. FIRST.org EPSS: https://www.first.org/epss/ (note: CVE-2026-103110 not yet scored at time of writing)
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-103110 not listed)
5. Pexip Security Advisories (vendor): https://www.pexip.com/security (consult the official advisory for authoritative fix versions 38.2 / 39.0 / 39.1 / 40.0)

Threat actor / exploitation evidence: No confirmed in-the-wild exploitation, threat actor campaign, or public PoC/exploit code was identified in the tracked sources at the time of writing. CISA KEV listing: NO. EPSS: not yet scored by FIRST.org.