CVE-2026-121943
MediumCVSS 4.8Summary
Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.
Risk Assessment
This could lead to application crashes or disclosure of sensitive stack data in displayed SIP fields.
Recommendation
Update sngrep to a version later than 1.9.0 that fixes the off-by-one length check.
Other vulnerabilities in sngrep
See all- CVE-2026-121944Medium
sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c. Attackers can supply a pcap file with link type NFLOG containing a non-payload TLV with length under 4, causing the capture thread to spin at full CPU and stop processing packets.
- CVE-2026-90558Critical
sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.
- CVE-2023-36192High
Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capture_ws_check_packet at /src/capture.c.
Original NVD description (English source)
Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS