CVE-2026-54632: SIPSorcery remote denial of service via malformed UDP packet

Executive brief

SIPSorcery is a library used to build real-time communication applications like VoIP and WebRTC video calls. A vulnerability allows a remote attacker to terminate active media sessions by sending a single specially crafted network packet. This can lead to service disruptions and dropped calls for users of the affected software.

Technical details

The vulnerability stems from two combined issues: improper input validation and improper exception handling. Specifically, 'RTPChannel.OnRTPPacketReceived' and 'STUNAttribute.ParseMessageAttributes' perform unchecked indexing on untrusted bytes from inbound UDP packets, leading to 'IndexOutOfRangeException' or 'NullReferenceException' when processing malformed or truncated packets. Furthermore, the UDP receive loop in 'UdpReceiver.EndReceiveFrom' was designed to close the entire channel upon encountering any exception rather than dropping the invalid packet. An unauthenticated remote attacker can exploit this during ICE connectivity checks to cause a Denial of Service (DoS). The issue is fixed in version 10.0.9.

Affected products

• sipsorcery-org SIPSorcery <= 10.0.8

Timeline

• 2026-07-28: advisory: GitHub Advisory published
• 2026-07-28: patched: Fixed in version 10.0.9

References

• https://api.github.com/users/Lougarou
• https://github.com/Lougarou
• https://api.github.com/users/Lougarou/gists%7B/gist_id%7D
• https://api.github.com/users/Lougarou/repos
• https://avatars.githubusercontent.com/u/4313217?v=4
• https://api.github.com/users/Lougarou/events%7B/privacy%7D