CVE-2026-90558 in sngrep
Summary
by MITRE • 09/12/2026
sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in sngrep versions through 1.8.4 represents a critical security flaw rooted in improper memory management within the application's SIP attribute formatting routines. Specifically, the software fails to adequately validate the length of header values before copying them into fixed-size stack buffers that are limited to 255 bytes. This lack of boundary checking allows attackers to craft malicious Session Initiation Protocol packets containing oversized fields such as Call-ID or X-Call-ID headers. When sngrep processes these specially crafted packets, it attempts to write data exceeding the allocated buffer space directly onto the call stack without performing necessary length checks or bounds validation.
From a technical perspective, this flaw is classified under CWE-121, which denotes a stack-based buffer overflow vulnerability. The core issue lies in the parsing and rendering logic of the SIP protocol analyzer, where input data from network packets is assumed to be within safe limits. By exploiting this assumption, an attacker can overwrite adjacent memory locations on the stack, including return addresses or function pointers. This overwriting capability enables two primary attack vectors: denial-of-service through application crashes caused by segmentation faults when the corrupted program counter attempts to execute invalid instructions, and potentially more severe remote code execution if the attacker successfully controls the overwritten data to redirect control flow to malicious shellcode injected into the buffer.
The operational impact of this vulnerability is significant for security professionals and network administrators who rely on sngrep for real-time SIP traffic analysis. Since snggrep is often used in production environments or during incident response activities, encountering a crafted packet can lead to immediate service disruption. In scenarios where the tool is run with elevated privileges or against untrusted networks, the risk escalates from simple data loss or application instability to full system compromise. The vulnerability affects both local file parsing and live capture modes if the input source includes maliciously constructed SIP traffic, making it a pervasive threat across various usage contexts of the software.
Industry frameworks categorize this type of exploitation under ATT&CK technique T1203, which covers Exploitation for Client Execution, as well as aspects of T1496, Resource Hijacking if used for denial-of-service purposes. The vulnerability aligns with CWE-787 and CWE-122 depending on the specific memory corruption mechanics observed during exploitation attempts. Mitigation strategies primarily involve upgrading to a patched version of snggrep that implements strict input validation and buffer size checks before processing SIP headers. Additionally, organizations should consider deploying network intrusion detection systems capable of identifying anomalous SIP packet sizes or malformed header structures as an interim control measure while patching is underway. Input sanitization at the application level remains the most effective long-term defense against such memory corruption vulnerabilities in protocol analyzers and similar networking tools.