SIPSorcery out-of-bounds read in SCTP SACK chunk parsing

Executive brief

SIPSorcery, a library used for real-time communications like VoIP and WebRTC, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted network packet that causes the software to crash its communication thread. This results in the permanent loss of all active data channels and prevents new communications until the service is restarted.

Technical details

An out-of-bounds read (CWE-125) exists in SctpSackChunk.ParseChunk within the SIPSorcery library. The component reads 'numGapAckBlocks' and 'numDuplicateTSNs' from an attacker-controlled SCTP SACK chunk and uses these values to loop through a buffer without validating them against the actual chunk length or receive buffer size. When a crafted packet exceeds the 262,144-byte buffer, an IndexOutOfRangeException is thrown. Because this exception is not caught by the specific recoverable exception handler in RTCSctpTransport.DoReceive, it terminates the dedicated SCTP receive thread, leading to a permanent Denial of Service for the SCTP association. This is fixed in version 10.0.14.

Affected products

• SIPSorcery SIPSorcery <= 10.0.13

Timeline

• 2026-08-12: advisory
• 2026-08-12: patched: Fixed in version 10.0.14

References

• https://api.github.com/users/manus-use
• https://github.com/manus-use
• https://api.github.com/users/manus-use/gists%7B/gist_id%7D
• https://api.github.com/users/manus-use/repos
• https://avatars.githubusercontent.com/u/213290975?v=4
• https://api.github.com/users/manus-use/events%7B/privacy%7D