A critical (CVSS 9.8) stack buffer overflow in the sngrep SIP packet analyzer through version 1.8.4 lets unauthenticated attackers crash the tool by sending oversized SIP header values. The advisory scoring treats the flaw as potentially allowing arbitrary code execution, though no public exploit demonstrating code execution has been reported.
What Is It
CVE-2026-90558 is a stack-based buffer overflow (CWE-121) in sngrep, the open-source SIP traffic capture and display utility maintained by Irontec. The flaw sits in the SIP attribute formatting routines, which write header values into fixed 255-byte stack buffers without adequate bounds checking. When a SIP header value exceeds that limit, the write runs past the end of the buffer during packet parsing and rendering.
Attackers trigger the condition by crafting malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields. The observable result is a crash; as with stack overflows generally, a sufficiently controlled overwrite could in principle lead to code execution in the context of the sngrep process, which is the outcome the advisory's impact ratings assume.
Why It Matters
The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base score 9.8, CRITICAL. A CVSS v4.0 secondary score of 9.3 (also CRITICAL) was assigned by the same source. Exploitation is network-reachable, requires no privileges, no user interaction, and no special attack conditions.
The exposure model is what makes this notable: sngrep is a diagnostic tool run by VoIP engineers against live SIP traffic. The attacker does not need to reach sngrep directly; they only need their packet to be observed by an analyst running a vulnerable build. Confidentiality, integrity, and availability impacts are all rated HIGH, reflecting the assumed code-execution outcome rather than a demonstrated one.
There is no evidence of active exploitation in the supplied data.
What's Vulnerable
- Vendor: irontec
- Product: sngrep
- Affected versions: all versions through and including 1.8.4 (
<= 1.8.4, semver); default status for other versions is unaffected.
Vulnerable code paths are referenced in src/sip_call.c (line 260) and src/sip_msg.c (line 150) at tag v1.8.4.
Patch Status
An upstream commit, 1ff74ee3ab5ff280e8ba976aa8c744dca57eb35b, is referenced in the advisory as addressing the issue. The NVD record was published 2026-09-12 with status "Received" and lists no fixed release version. Operators running sngrep 1.8.4 or earlier should track the upstream repository and move to a build that includes the referenced commit.