Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck

CVE-2026-121943Irontec sngrep through 1.9.0 Out-of-Bounds Stack Read via sip_check_packet

Medium 4.8

In plain English

A medium-severity security flaw in sngrep from irontec. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.6% (higher than 93% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)5.6%top 7.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	sngrep	no fix listed	DEBIAN-CVE-2026-121943
Debian:13	sngrep	no fix listed	DEBIAN-CVE-2026-121943
Debian:14	sngrep	no fix listed	DEBIAN-CVE-2026-121943
Ubuntu:22.04:LTS	sngrep	no fix listed	UBUNTU-CVE-2026-121943
Ubuntu:24.04:LTS	sngrep	no fix listed	UBUNTU-CVE-2026-121943
Ubuntu:26.04:LTS	sngrep	no fix listed	UBUNTU-CVE-2026-121943
Ubuntu:26.10	sngrep	no fix listed	UBUNTU-CVE-2026-121943

Affected products (as reported)

Vendor	Product	Versions
irontec	sngrep	0 – through 1.9.0

Weakness: CWE-170 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

References

https://github.com/irontec/sngrep/issues/589 issue-tracking
https://hackmd.io/@haindpwn/sngrep-sip-payload-missing-nul-oob-read third-party-advisory
https://github.com/irontec/sngrep/blob/v1.9.0/src/sip.c#L396-L410 technical-description
VulnCheck Advisory: Irontec sngrep through 1.9.0 Out-of-Bounds Stack Read via sip_check_packet third-party-advisory
https://hackmd.io/@haindpwn/cve-2026-121943-121944-sngrep-sip-payload-missing-nul-oob-read exploit