sipsorcery-org SIPSorcery up to 10.0.13 SCTP SACK Chunk Parser SctpSackChunk.ParseChunk numGapAckBlocks/numDuplicateTSNs out-of-bounds

Summaryinfo

A vulnerability marked as problematic has been reported in sipsorcery-org SIPSorcery up to 10.0.13. Affected by this vulnerability is the function SctpSackChunk.ParseChunk of the component SCTP SACK Chunk Parser. The manipulation of the argument numGapAckBlocks/numDuplicateTSNs leads to out-of-bounds. This vulnerability is uniquely identified as CVE-2026-123805. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in sipsorcery-org SIPSorcery up to 10.0.13. It has been rated as problematic. This issue affects the function SctpSackChunk.ParseChunk of the component SCTP SACK Chunk Parser. The manipulation of the argument numGapAckBlocks/numDuplicateTSNs with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is availability. The summary by CVE is:

SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.14, SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields from an attacker-controlled SCTP SACK chunk without checking that the corresponding entries fit the declared chunk length. A negotiated WebRTC peer can send a checksum-valid malformed SACK chunk that drives the parser beyond the 262144-byte receive buffer. The resulting IndexOutOfRangeException bypasses the recoverable ApplicationException handler in RTCSctpTransport.DoReceive, causing the generic handler to exit the dedicated receive loop and permanently terminate the SCTP association and all data channels. This issue is fixed in 10.0.14.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-123805 since 11/06/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 10.0.14 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• sipsorcery-org

Name

• SIPSorcery

Version

• 10.0.0
• 10.0.1
• 10.0.2
• 10.0.3
• 10.0.4
• 10.0.5
• 10.0.6
• 10.0.7
• 10.0.8
• 10.0.9
• 10.0.10
• 10.0.11
• 10.0.12
• 10.0.13

Website

• Product: https://github.com/sipsorcery-org/sipsorcery/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion