EUVD-2026-76903
GHSA-5vq7-hmwf-89w5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable via crafted SIP packets with no authentication or user interaction; scope unchanged as sngrep is a single userspace process with no privilege boundary crossed.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.
AnalysisAI
Stack buffer overflows in sngrep through 1.8.4 allow unauthenticated remote attackers to crash or execute arbitrary code on any host running sngrep while actively capturing SIP traffic. The flaws reside in call_get_attribute() (src/sip_call.c) and msg_get_attribute() (src/sip_msg.c), where unbounded sprintf calls copy SIP header values - including Call-ID, X-Call-ID, Reason, From, To, Contact, and request/response strings - into a fixed 255-byte stack buffer without length enforcement. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | sngrep must be actively running and capturing SIP traffic on a network interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 9.3 accurately reflects the low exploitation barrier: the attack requires no authentication, no user interaction, and no unusual configuration - only that sngrep be running and monitoring a network interface reachable by the attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix from commit 1ff74ee3ab5ff280e8ba976aa8c744dca57eb35b (https://github.com/irontec/sngrep/commit/1ff74ee3ab5ff280e8ba976aa8c744dca57eb35b), which patches all affected `sprintf` calls in both src/sip_call.c and src/sip_msg.c to enforce truncation at SIP_ATTR_MAXLEN - 1 bytes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running sngrep version 1.8.4 and earlier across your environment and determine which are actively capturing SIP traffic; obtain and apply the vendor-released patch to upgrade beyond version 1.8.4 immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capture_ws_check_packet at /src/capture.
Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capture_packet_reasm_ip at /src/capture.
Sngrep v1.6.0 was discovered to contain a stack buffer overflow via the function packet_set_payload at /src/packet.c. Ra
Irontec Sngrep v1.8.1 was discovered to contain a heap buffer overflow via the function rtp_check_packet at /sngrep/src/
A stack-buffer overflow vulnerability exists in all versions of sngrep since v1.4.1. Rated critical severity (CVSS 9.8),
A buffer overflow vulnerability exists in all versions of sngrep since v0.4.2, due to improper handling of 'Call-ID' and
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today