CVE-2026-90558: sngrep Buffer Overflow Vulnerability

CVE-2026-90558 Overview

CVE-2026-90558 is a stack buffer overflow vulnerability in sngrep through version 1.8.4, an open-source SIP (Session Initiation Protocol) message capture and analysis tool. The flaw resides in SIP attribute formatting routines that copy header values into fixed 255-byte stack buffers without proper length validation. Attackers can craft malicious SIP packets containing oversized Call-ID, X-Call-ID, or other header fields to overflow these buffers. Successful exploitation may cause the tool to crash or execute arbitrary code during packet parsing and rendering. The vulnerability is classified under [CWE-121: Stack-based Buffer Overflow].

Critical Impact
Remote attackers can send unauthenticated, malformed SIP packets to trigger stack corruption in sngrep, enabling denial of service or arbitrary code execution on the monitoring host.

Affected Products

Irontec sngrep versions up to and including 1.8.4
Deployments capturing SIP traffic from untrusted networks
Any environment where sngrep parses attacker-controlled SIP headers

Discovery Timeline

2026-09-12 - CVE-2026-90558 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90558

Vulnerability Analysis

The vulnerability affects sngrep's SIP attribute formatting logic in src/sip_call.c and src/sip_msg.c. When rendering call metadata, the code uses sprintf to write header values into a fixed-size buffer defined by SIP_ATTR_MAXLEN (255 bytes). Two flaw patterns exist. First, SIP_ATTR_CALLID and SIP_ATTR_XCALLID cases use sprintf(value, "%s", ...) with no length limit, allowing unbounded copies. Second, other cases use sprintf(value, "%.*s", SIP_ATTR_MAXLEN, ...) but pass the full buffer size as the precision, permitting a copy equal to the buffer length plus the terminating NUL byte, corrupting one byte of adjacent stack memory.

Root Cause

The root cause is missing or incorrect bounds enforcement when formatting SIP header values into stack buffers. The sprintf calls either omit precision specifiers entirely or use a precision equal to the buffer size, leaving no space for the trailing NUL byte. Attacker-supplied SIP header fields longer than 255 bytes therefore write past the buffer boundary on the stack.

Attack Vector

The attack requires only network reachability and no authentication. An attacker sends a crafted SIP packet on a network segment monitored by sngrep. When the tool parses and formats fields such as Call-ID, X-Call-ID, From, To, or the request/response method, the oversized value overflows the stack buffer. Depending on compiler protections, stack layout, and payload structure, this yields a crash or arbitrary code execution in the context of the sngrep process.

// Patch: src/sip_call.c - bound Call-ID and X-Call-ID copies
            sprintf(value, "%d", call->index);
            break;
        case SIP_ATTR_CALLID:
-           sprintf(value, "%s", call->callid);
+           sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->callid);
            break;
        case SIP_ATTR_XCALLID:
-           sprintf(value, "%s", call->xcallid);
+           sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->xcallid);
            break;
        case SIP_ATTR_MSGCNT:
            sprintf(value, "%d", vector_count(call->msgs));

Source: GitHub sngrep Commit 1ff74ee

// Patch: src/sip_msg.c - reserve one byte for NUL terminator
            break;
        case SIP_ATTR_METHOD:
-           sprintf(value, "%.*s", SIP_ATTR_MAXLEN, sip_get_msg_reqresp_str(msg));
+           sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, sip_get_msg_reqresp_str(msg));
            break;
        case SIP_ATTR_SIPFROM:
-           sprintf(value, "%.*s", SIP_ATTR_MAXLEN, msg->sip_from);
+           sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, msg->sip_from);
            break;
        case SIP_ATTR_SIPTO:
-           sprintf(value, "%.*s", SIP_ATTR_MAXLEN, msg->sip_to);
+           sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, msg->sip_to);
            break;

Source: GitHub sngrep Commit 1ff74ee

Detection Methods for CVE-2026-90558

Indicators of Compromise

SIP packets containing Call-ID, X-Call-ID, From, or To headers exceeding 255 bytes on monitored network segments.
Unexpected sngrep process crashes, segmentation faults, or core dumps on hosts running SIP capture tooling.
Anomalous child processes or shell invocations originating from the sngrep process.

Detection Strategies

Deploy network intrusion detection signatures that inspect SIP header lengths and alert on values exceeding 255 bytes.
Monitor process telemetry on capture hosts for sngrep termination signals, coredumps, or unexpected memory faults.
Correlate SIP traffic volume anomalies with sngrep runtime instability to identify targeted exploitation attempts.

Monitoring Recommendations

Enable audit logging on hosts running sngrep and forward process events to a centralized analytics pipeline.
Track outbound connections and process lineage from any user or service account executing sngrep.
Review SIP traffic captures for repeated malformed packets, which may indicate reconnaissance or exploit attempts.

How to Mitigate CVE-2026-90558

Immediate Actions Required

Upgrade sngrep to a version containing commit 1ff74ee3ab5ff280e8ba976aa8c744dca57eb35b or build from patched sources.
Restrict sngrep usage to trusted network segments and avoid running it against SIP traffic originating from untrusted peers.
Run sngrep under a low-privilege, non-root account to limit the blast radius of any successful exploitation.

Patch Information

The upstream fix is available in the Irontec sngrep repository as commit 1ff74ee. The patch changes the sprintf precision specifier to SIP_ATTR_MAXLEN - 1 and adds explicit length limits to the previously unbounded Call-ID and X-Call-ID cases. Distributions packaging sngrep 1.8.4 or earlier should rebuild from the patched source. Refer to the VulnCheck Advisory on sngrep for additional context.

Workarounds

Filter SIP traffic upstream to drop packets with headers exceeding a safe length threshold before they reach the capture host.
Isolate the capture host on a management VLAN with strict access controls limiting SIP source addresses.
Compile sngrep with stack protection flags such as -fstack-protector-strong and -D_FORTIFY_SOURCE=2 to reduce exploitability.

bash

# Build sngrep from patched source with hardening flags
git clone https://github.com/irontec/sngrep.git
cd sngrep
git checkout 1ff74ee3ab5ff280e8ba976aa8c744dca57eb35b
export CFLAGS="-O2 -fstack-protector-strong -D_FORTIFY_SOURCE=2 -fPIE"
export LDFLAGS="-pie -Wl,-z,relro,-z,now"
./bootstrap.sh
./configure --with-openssl
make && sudo make install