CVE-2026-121943 in sngrep
Summary
by MITRE • 11/04/2026
Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in Irontec sngrep versions through 1.9.0 represents a critical memory safety flaw rooted in improper boundary validation during the processing of Session Initiation Protocol packets. Specifically, the defect resides within the sip_check_packet and sip_validate_packet functions, which are responsible for parsing and validating incoming SIP traffic. The core technical issue is an off-by-one error in the length check applied to SIP payloads that approach or exceed a size threshold of 10240 bytes. This miscalculation allows the application to read memory locations beyond the allocated buffer boundaries on the stack, leading to an out-of-bounds read condition. Such vulnerabilities are classically categorized under CWE-125, which describes Out-of-Bounds Read scenarios where a program reads data past the end of a valid buffer.
From an operational perspective, this vulnerability poses significant risks to both system stability and information confidentiality. An attacker with network access can exploit this flaw by sending specially crafted UDP or TCP SIP packets that trigger the erroneous memory read during parsing. Alternatively, an adversary could supply a maliciously constructed pcap file containing these oversized payloads for analysis within sngrep. The immediate consequence of such exploitation is often a denial of service, manifested as a crash or segmentation fault in the sngrep application due to accessing invalid stack memory. However, beyond availability impacts, the vulnerability also presents a serious confidentiality risk. By triggering the out-of-bounds read, an attacker may be able to leak adjacent stack bytes into displayed SIP fields. This information leakage can potentially expose sensitive data stored on the call stack, such as return addresses or other local variables, which could aid in further exploitation attempts like buffer overflow attacks by revealing memory layout details.
This type of vulnerability aligns with common attack patterns observed in network protocol parsers and is relevant to ATT&CK techniques involving resource hijacking for denial of service or data exfiltration through side channels. The lack of strict bounds checking on large payloads highlights a gap in defensive coding practices, particularly when handling variable-length inputs from untrusted sources like the public internet or captured traffic files. To mitigate this risk, users should immediately upgrade to sngrep version 1.9.0 or later where these boundary checks have been corrected. In environments where upgrading is not immediately feasible, deploying network intrusion detection systems that inspect SIP packet sizes and drop oversized packets can provide a layer of defense against exploitation attempts. Additionally, developers integrating similar parsing logic into other applications should enforce strict length validation before processing any input buffer to prevent out-of-bounds memory access vulnerabilities.