# CVE-2026-90558: sngrep stack buffer overflow in SIP header formatting

Source: https://junglewise.ai/threats/cve-2026-90558-sngrep-stack-buffer-overflow-in-sip-header-formatting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-12. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90558 · Severity: critical · CVSS 9.8 · Published 2026-09-12

sngrep is an ncurses-based tool for viewing and analyzing SIP (Session Initiation Protocol) message flows in VoIP systems. The vulnerability allows attackers to crash the application or execute arbitrary code by sending specially crafted SIP packets with oversized header fields (such as Call-ID or X-Call-ID) that exceed internal buffer limits, potentially compromising systems used for VoIP monitoring and analysis.

Technologies: [Irontec Sngrep](https://junglewise.ai/threats/technologies/sngrep). Vendors: [Irontec](https://junglewise.ai/threats/vendors/irontec).

## Quick answers

**Is CVE-2026-90558 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90558 being exploited in the wild.

**How severe is CVE-2026-90558?** Critical severity, with a CVSS score of 9.8, published 12 September 2026.

**Which products and versions are affected?** Irontec Sngrep through 1.8.4.

**Is there a fix for CVE-2026-90558?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90558 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-90558?** Check whether you run Irontec Sngrep at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stack buffer overflow in SIP attribute formatting routines in sngrep through version 1.8.4. When processing incoming SIP packets, the application fails to properly validate header field lengths and copies values into fixed-size 255-byte stack buffers without bounds checking. An attacker can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to trigger the overflow during packet parsing and rendering. This can lead to stack corruption, denial of service (crash), or arbitrary code execution. The vulnerable code paths are in the SIP packet processing and rendering components (src/sip_call.c and related formatting routines).

## Affected products

- irontec sngrep through 1.8.4

## Timeline

- 2026-09-12: disclosed

## References

- [https://github.com/irontec/sngrep](https://github.com/irontec/sngrep)
- [https://github.com/irontec/sngrep/blob/v1.8.4/src/sip_call.c](https://github.com/irontec/sngrep/blob/v1.8.4/src/sip_call.c)

## Related threats

- [sngrep infinite loop in capture_packet_reasm_ip](https://junglewise.ai/threats/cve-2026-121944-sngrep-through-1-9-0-contains-an-infinite-loop-vulnerability-in)
- [Irontec sngrep out-of-bounds stack read in SIP parser](https://junglewise.ai/threats/cve-2026-121943-irontec-sngrep-through-1-9-0-contains-an-out-of-bounds-stack)