Read the docs
TI-2026-85054 Aliases CVE-2026-121943GHSA-v6rr-x6vh-q7q4

Out-of-bounds stack read in Irontec sngrep SIP packet parsing

Priority MEDIUM 61CWE-170Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Irontec sngrep through 1.9.0 contains an out-of-bounds stack read in sip_check_packet, caused by an off-by-one length check on 10240-byte SIP payloads. A remote attacker can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.05551 92nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
irontecsngrepup to 1.9.0—No fix listedCNA
  • sngrep Vendorirontec Affected up to 1.9.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for sngrep.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-121943
  2. 2026-11-04 Alias added: GHSA-v6rr-x6vh-q7q4
  3. 2026-11-04 Affected versions changed · Red Hat
  4. 2026-11-04 CVSS score added · Red Hat
  5. 2026-11-04 CISA SSVC decision points changed

References

Advisory 1

Other 2

  • TI-2024-23438 Irontec Sngrep v1.8.1 was discovered to contain a heap buffer overflow via the function… CVSS 3.1HIGH 7.5
  • TI-2023-18152 Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function… CVSS 3.1HIGH 7.8
  • TI-2023-15298 Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function… CVSS 3.1HIGH 7.8
  • TI-2023-15297 Sngrep v1.6.0 was discovered to contain a stack buffer overflow via the function packet_set_payload at /src/packet.c. CVSS 3.1HIGH 7.8
  • TI-2026-85055 Infinite loop in sngrep allows denial of service via crafted pcap CVSS 4.0MEDIUM 6.8
  • TI-2024-02922 Stack-Buffer Overflow in 'Content-Length' and 'Warning' Header Processing in sngrep CVSS 3.1CRITICAL 9.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences