CVE-2026-90558
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.
Risk Assessment
The vulnerability can lead to remote code execution or application crashes in sngrep when processing malicious SIP traffic, posing a serious threat to analyst workstations and VoIP monitoring systems.
Recommendation
Update sngrep to a version newer than 1.8.4 if available, or limit exposure to untrusted SIP traffic until a patch is released.
Other vulnerabilities in sngrep
See all- CVE-2026-121944Medium
sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c. Attackers can supply a pcap file with link type NFLOG containing a non-payload TLV with length under 4, causing the capture thread to spin at full CPU and stop processing packets.
- CVE-2026-121943Medium
Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.
- CVE-2023-36192High
Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capture_ws_check_packet at /src/capture.c.
Original NVD description (English source)
sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS