Medium severity4.8NVD Advisory· Published Nov 4, 2026· Updated Nov 4, 2026

CVE-2026-121943

Description

Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.

Affected products

Irontec/Sngrepllm-fuzzy
Range: <=1.9.0

Patches

Vulnerability mechanics

References

github.com/irontec/sngrep/blob/v1.9.0/src/sip.cnvd
github.com/irontec/sngrep/issues/589nvd
hackmd.io/@haindpwn/sngrep-sip-payload-missing-nul-oob-readnvd
www.vulncheck.com/advisories/irontec-sngrep-through-1.9.0-out-of-bounds-stack-read-via-sip-check-packetnvd

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000