Executive brief
sngrep is an ncurses-based tool for viewing and analyzing SIP (Session Initiation Protocol) message flows in VoIP systems. The vulnerability allows attackers to crash the application or execute arbitrary code by sending specially crafted SIP packets with oversized header fields (such as Call-ID or X-Call-ID) that exceed internal buffer limits, potentially compromising systems used for VoIP monitoring and analysis.
Technical details
The vulnerability is a stack buffer overflow in SIP attribute formatting routines in sngrep through version 1.8.4. When processing incoming SIP packets, the application fails to properly validate header field lengths and copies values into fixed-size 255-byte stack buffers without bounds checking. An attacker can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to trigger the overflow during packet parsing and rendering. This can lead to stack corruption, denial of service (crash), or arbitrary code execution. The vulnerable code paths are in the SIP packet processing and rendering components (src/sip_call.c and related formatting routines).
Affected products
- irontec sngrep through 1.8.4
Timeline
- 2026-09-12: disclosed