Vulnerability · Published Sep 12, 2026 · Assigned by VulnCheck

CVE-2026-90558sngrep through 1.8.4 Stack Buffer Overflow via SIP Headers

Critical 9.8

In plain English

A critical-severity stack buffer overflow in sngrep from irontec. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.9%top 40.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	sngrep	no fix listed	DEBIAN-CVE-2026-90558
Debian:13	sngrep	no fix listed	DEBIAN-CVE-2026-90558
Debian:14	sngrep	1.8.4-2	DEBIAN-CVE-2026-90558
Ubuntu:22.04:LTS	sngrep	no fix listed	UBUNTU-CVE-2026-90558
Ubuntu:24.04:LTS	sngrep	no fix listed	UBUNTU-CVE-2026-90558
Ubuntu:26.04:LTS	sngrep	no fix listed	UBUNTU-CVE-2026-90558
Ubuntu:26.10	sngrep	no fix listed	UBUNTU-CVE-2026-90558

Affected products (as reported)

Vendor	Product	Versions
irontec	sngrep	0 – through 1.8.4

Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Patch Commit patch
https://github.com/irontec/sngrep product
https://github.com/irontec/sngrep/blob/v1.8.4/src/sip_call.c#L260 technical-description
https://github.com/irontec/sngrep/blob/v1.8.4/src/sip_msg.c#L150 technical-description
VulnCheck Advisory: sngrep through 1.8.4 Stack Buffer Overflow via SIP Headers third-party-advisory