CVE-2026-121943

MEDIUM 4.8

Irontec sngrep through 1.9.0 Out-of-Bounds Stack Read via sip_check_packet

CVSS Score

4.8

EPSS Score

0.0%

EPSS Percentile

0th

Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.

CWE	CWE-170
Vendor	irontec
Product	sngrep
Published	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for irontec sngrep

Be the first to know when new medium vulnerabilities affecting irontec sngrep are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Affected Versions

irontec / sngrep

0 ≤ 1.9.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/irontec/sngrep/issues/589 hackmd.io: https://hackmd.io/@haindpwn/sngrep-sip-payload-missing-nul-oob-read github.com: https://github.com/irontec/sngrep/blob/v1.9.0/src/sip.c#L396-L410 vulncheck.com: https://www.vulncheck.com/advisories/irontec-sngrep-through-1.9.0-out-of-bounds-stack-read-via-sip-check-packet

Credits

HaiND from the Post and Telecommunication Institute of Technology