OpenSIPS CVE-2026-110679

Exploitation requires that the target OpenSIPS instance load the rtpproxy module AND that its routing script invoke rtpproxy_offer() or rtpproxy_answer() on attacker-reachable SIP transactions - these functions process SDP/media-relay negotiation and are the specific trigger point. The attacker must be able to deliver SIP messages (e.g., INVITE with a crafted SDP body) to the server's signaling interface. Limiting factors: servers that do not use the rtpproxy module, or that filter/authenticate SIP traffic before it reaches these script functions, are not exposed; impact is bounded to memory disclosure or process crash (no code execution indicated). Authentication is not required per PR:N in the CVSS vector.

This is a medium-severity (CVSS 4.0 base 6.9) out-of-bounds read (CWE-125) in the OpenSIPS rtpproxy module. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated vector with no user interaction, which sounds alarming - but the impact metrics are the moderating factor: VC:L/VI:L/VA:L means only limited confidentiality, integrity, and availability impact, consistent with an information-disclosure/crash primitive rather than code execution. No EPSS score, KEV listing, or POC is present in the provided data, so there is NO evidence of active exploitation or public exploit code - this is 'no public exploit identified at time of analysis.' The disclosure originates from VulDB (a vulnerability aggregator) rather than a first-party security researcher advisory with exploit detail, and the vendor has published a GitHub Security Advisory (GHSA-qv9x-v8jq-434w) plus fixed releases. Net assessment: this is a legitimate but moderate-priority issue - patch in the normal cycle for internet-facing or multi-tenant OpenSIPS deployments that use the rtpproxy module, but it is not an emergency drop-everything item absent exploitation signals. Note the vendor-assigned VI:L (integrity) is questionable for a pure out-of-bounds READ, which normally affects confidentiality and availability, not integrity - flagged in confidence_notes, not auto-corrected.

A remote attacker sends a crafted SIP INVITE (or answer) with a malformed SDP body to an OpenSIPS server whose routing script invokes rtpproxy_offer()/rtpproxy_answer(). The malformed input causes the rtpproxy module to read beyond an allocated buffer, potentially leaking adjacent memory contents back into processing or crashing the worker process. No public exploit code is identified at time of analysis, and exploitation requires that the rtpproxy module actually be loaded and called in the configuration.