Sofia-SIP EUVD-2026-101131

No special configuration is required: the only prerequisite is a network-reachable Sofia-SIP endpoint (e.g., a FreeSWITCH server) that accepts and parses SIP INVITE requests containing a multipart MIME Content-Type, which is standard SIP behavior. Exploitation is remote and unauthenticated per the CVSS vector (AV:N/PR:N/UI:N) with no user interaction. The practical limiting factor is reachability - the SIP service must be exposed to the attacker (directly or through a proxy that forwards multipart INVITEs) and running a vulnerable version at or below 1.13.18; no credentials, victim interaction, or non-default settings are needed.

This is a remotely triggerable, unauthenticated denial-of-service with a public proof-of-concept, which raises its operational priority above its modest numeric score. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the easiest possible reachability - network vector, low complexity, no authentication, no user interaction - so any internet-facing Sofia-SIP/FreeSWITCH endpoint that parses multipart SIP bodies can be crashed with a single crafted INVITE, and the attack is trivially repeatable for sustained outage. However, impact is strictly availability (VC:N/VI:N/VA:L, CWE-125 out-of-bounds READ): there is no code execution and no evidence the out-of-bounds memcmp returns data to the attacker, so despite the 'Information Disclosure' tag this behaves as a crash/DoS, not a data-leak. Signals are only partially present: a public POC exists (hackmd write-up) and VulnCheck published an advisory, but there is NO CISA KEV listing and NO EPSS score in the provided data, so widespread automated exploitation cannot be confirmed from the inputs - treat this as a real, easy-to-exploit availability risk for exposed VoIP/SIP infrastructure rather than a confirmed in-the-wild campaign. Note also a scoring tension: the vendor rated availability as VA:L (partial), yet a remotely repeatable full process crash arguably warrants a higher availability impact - verify observed crash/restart behavior in your environment.

An attacker reachable over the network sends a SIP INVITE to a Sofia-SIP-based service (such as a FreeSWITCH server) with a multipart Content-Type whose MIME boundary string is longer than the message body. When msg_multipart_parse() calls memcmp, it reads past the end of the heap buffer and the process crashes, denying service. A public proof-of-concept write-up exists, lowering the skill required to reproduce the attack.