EUVD-2026-38870
GHSA-2256-5c36-mwcj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remotely triggered (AV:N) but only with the SIP conntrack/NAT helper enabled and a crafted SDP (AC:H); a one-byte stack overflow primarily yields DoS (A:H) with limited integrity impact and no clear disclosure.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: remove sprintf usage
Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check.
Increase buffer size in mangle_content_len() while at it.
BUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270 Write of size 1 at addr [..] vsnprintf+0xea5/0x1270 sprintf+0xb1/0xe0 mangle_content_len+0x1ac/0x280 nf_nat_sdp_session+0x1cc/0x240 process_sdp+0x8f8/0xb80 process_invite_request+0x108/0x2b0 process_sip_msg+0x5da/0xf50 sip_help_tcp+0x45e/0x780 nf_confirm+0x34d/0x990 [..]
AnalysisAI
Stack out-of-bounds write in the Linux kernel's netfilter connection-tracking SIP application-layer gateway (ALG) allows remote attackers to corrupt kernel stack memory by sending crafted SIP/SDP traffic through a NAT device. The flaw lives in mangle_content_len(), reached via nf_nat_sdp_session → process_sdp when rewriting the SDP Content-Length during SIP INVITE handling, where an unbounded sprintf() overflowed an undersized stack buffer (caught by KASAN). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target Linux host to have the netfilter SIP connection-tracking/NAT helper (nf_conntrack_sip / nf_nat_sip) loaded and applied to the traffic, and to be performing NAT on SIP signaling so that nf_nat_sdp_session → mangle_content_len() rewrites the SDP Content-Length of an attacker-supplied SIP INVITE/SDP message. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals conflict and should be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a crafted SIP INVITE with a malformed SDP body to (or through) a Linux host acting as a SIP-aware NAT gateway; as the kernel rewrites the SDP Content-Length in mangle_content_len(), the oversized value overflows the fixed stack buffer, corrupting adjacent kernel stack memory and most likely panicking the host (denial of service). No public exploit is identified at time of analysis, and reliable code execution from a single-byte stack overwrite would require significant additional work; the attack needs the SIP conntrack/NAT helper to be active on the targeted path. |
| Remediation | Vendor-released patch: upgrade to a fixed stable kernel for your series - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, or 7.0.10 (or later), or apply the corresponding distribution kernel update once it ships the referenced commits (https://git.kernel.org/stable/c/2f793ba78470a99f40389b7dc60a81d9f5ad3956 and the related stable backports). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit production systems for SIP conntrack/NAT helper enablement (run: modinfo nf_nat_sip, check if module is loaded; verify iptables rules for SIP traffic handling). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today