CVE-2026-121943
Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off
CVSS
4.8
Medio
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 4 nov 2026 · Última mod.: 4 nov 2026 · CWE-170
Sin historial EPSS suficiente todavía.
Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.
- github.comhttps://github.com/irontec/sngrep/blob/v1.9.0/src/sip.c#L396-L410
- github.comhttps://github.com/irontec/sngrep/issues/589
- hackmd.iohttps://hackmd.io/@haindpwn/sngrep-sip-payload-missing-nul-oob-read
- www.vulncheck.comhttps://www.vulncheck.com/advisories/irontec-sngrep-through-1.9.0-out-of-bounds-stack-read-via-sip-check-packet
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-571856.5 MED41.3%
——12Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the `PJSIP MWI body parser` by sending a carefully crafted `SIP NOTIFY` request. The attacker must pass SIP authentication using either a username/password or `source IP address matching`. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.5dCVE-2026-1144573.7 BAJ30.9%
——9A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated memory boundaries, which can cause an Apache worker process to crash.9dCVE-2026-968605.5 MED32.8%
——10Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to disclose information locally.7dCVE-2026-968505.5 MED38.3%
——11Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally.19dCVE-2026-837817.8 ALT29.0%
——9Improper null termination in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.2dCVE-2026-818823.3 BAJ6.0%
——2radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The vulnerability is triggered by running the explicit pFB or pFBj commands on untrusted binary property-list data. The json encoder treated the converted data as a nul-terminated c string and could continue reading beyond the allocation. This can cause disclosure of uninitialized or adjacent heap contents in JSON output and possible process termination. This issue is fixed in version 6.2.0.37d