Critical severity9.8NVD Advisory· Published Sep 12, 2026· Updated Sep 23, 2026

CVE-2026-90558

Description

sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Irontec/Sngrepreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=1.8.4
osv-coords
pkg:rpm/opensuse/sngrep&distro=openSUSE%20Tumbleweed
Range: < 1.8.4-2.1

Patches

Vulnerability mechanics

References

github.com/irontec/sngrep/blob/v1.8.4/src/sip_call.cnvd
github.com/irontec/sngrep/blob/v1.8.4/src/sip_msg.cnvd
github.com/irontec/sngrep/commit/1ff74ee3ab5ff280e8ba976aa8c744dca57eb35bnvd
www.vulncheck.com/advisories/sngrep-through-1.8.4-stack-buffer-overflow-via-sip-headersnvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000