CVE-2026-110679 in OpenSIPS
Summary
by MITRE • 10/15/2026
A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxy_offer/rtpproxy_answer of the component rtpproxy. This manipulation causes out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 and 4.0.2 is sufficient to resolve this issue. It is advisable to upgrade the affected component.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
A critical security vulnerability has been identified within OpenSIPS, specifically affecting versions up to 3.6.8 for the stable branch and 4.0.1 for the development branch. The flaw resides in the rtpproxy module, which is responsible for managing Real-Time Transport Protocol proxying operations essential for VoIP communications. Specifically, the vulnerability impacts the rtpproxy_offer and rtpproxy_answer functions, which are invoked during session initiation and modification processes to negotiate media paths between endpoints. This issue manifests as an out-of-bounds read error, a type of memory safety violation where the application attempts to access data beyond the intended buffer boundaries. Such errors typically arise from improper validation of input parameters or incorrect calculation of array indices when processing SIP messages that trigger these specific functions.
The technical nature of this vulnerability classifies it under Common Weakness Enumeration CWE-125, which describes out-of-bounds read operations. In the context of OpenSIPS, a high-performance open-source SIP server, memory corruption issues can have severe consequences for system stability and security integrity. When an attacker sends specially crafted SIP packets to trigger the rtpproxy_offer or rtappoxy_answer functions with malformed parameters, the application may read sensitive information from adjacent memory locations. This could potentially lead to the leakage of internal state data, credentials, or other confidential information stored in the server's memory space. Furthermore, depending on how the operating system handles such memory access violations and whether additional exploitation techniques are employed, this flaw could theoretically be leveraged for further attacks, although the primary immediate risk is information disclosure and potential service disruption through application crashes.
From an operational perspective, this vulnerability poses a significant threat because it can be exploited remotely without requiring prior authentication. Attackers located on the network or internet can target OpenSIPS instances that are configured to use the rtpproxy module for media handling. The ability to initiate such attacks remotely expands the attack surface considerably, allowing malicious actors to probe vulnerable systems from any location with network connectivity to the SIP server. Successful exploitation could result in denial of service conditions due to application instability or segmentation faults caused by invalid memory access patterns. Additionally, if the out-of-bounds read exposes cryptographic keys or session tokens, it could compromise the confidentiality and integrity of ongoing VoIP sessions, enabling eavesdropping or man-in-the-middle attacks against voice communications handled by the compromised server.
To mitigate this risk, organizations running OpenSIPS must immediately upgrade to version 3.6.9 for the stable branch or version 4.0.2 for the development branch. These releases contain patches that address the memory handling errors within the rtpproxy module functions. Prior to upgrading, administrators should assess their current deployment configurations and ensure that backups of configuration files are preserved. It is also advisable to review access control lists and firewall rules to restrict direct SIP traffic from untrusted networks until the patching process is complete. For environments where immediate upgrade is not feasible due to operational constraints, implementing strict input validation at the network perimeter or disabling the rtpproxy module if it is not strictly required can serve as temporary compensating controls. Continuous monitoring of system logs for unusual memory-related errors or segmentation faults should also be maintained post-upgrade to ensure the vulnerability has been fully resolved and no residual instability remains in the production environment.