CVE-2026-90558 sngrep through 1.8.4 Stack Buffer Overflow via SIP Headers
Attackers can execute arbitrary code or cause denial of service in sngrep by sending malicious SIP packets with oversized headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90558?
CVE-2026-90558 is a critical memory corruption vulnerability in irontec sngrep, published on 12 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.
Weakness: CWE-121
Which versions are affected by CVE-2026-90558?
Linux distribution packages (1)
sngrep openSUSE:Tumbleweed | All versions | 1.8.4-2.1 |
How do I fix CVE-2026-90558?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-90558 being exploited?
There is no known exploitation of CVE-2026-90558 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-90558, GHSA-5vq7-hmwf-89w5, UBUNTU-CVE-2026-90558, openSUSE-SU-2026:11791-1.