CVE-2026-121943 Details
Description
Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.
A vulnerability allowing an out-of-bounds stack read has been identified in Irontec Sngrep versions through 1.9.0. This issue arises in the SIP packet parser due to an off-by-one length check on SIP payloads of 10240 bytes. Remote attackers can exploit this vulnerability by sending crafted SIP packets over UDP or TCP, or by using a specially crafted pcap file. The exploitation can lead to a crash of the Sngrep application or cause adjacent stack bytes to be leaked into the displayed SIP fields.
Users can upgrade to Sngrep version 1.9.1 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haindpwn/cve-2026-121943-121944-sngrep-sip-payload-missing-nul-oob-read | CISA-ADP | |
| https://github.com/irontec/sngrep/blob/v1.9.0/src/sip.c#L396-L410 | [email protected] | Source CodeVendor |
| https://github.com/irontec/sngrep/issues/589 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://hackmd.io/@haindpwn/sngrep-sip-payload-missing-nul-oob-read | [email protected] | Technical Analysis |
| https://www.vulncheck.com/advisories/irontec-sngrep-through-1.9.0-out-of-bounds-stack-read-via-sip-check-packet | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-170 | Improper Null Termination | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Irontec sngrep | <= 1.9.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Nov 4, 2026 | New CVE Received | [email protected] |