sngrep SIP Header Stack Buffer Overflow

Technical Analysis

The vulnerability stems from unsafe fixed-size stack buffer usage in sngrep's SIP header formatting and rendering routines, which fail to validate header length before copying data, classic CWE-121 stack-based buffer overflow. Attackers can exploit this by crafting SIP packets with oversized Call-ID, X-Call-ID, or similar header fields that exceed the hardcoded 255-byte limit, corrupting the stack during packet parsing or terminal rendering. Given the CVSS score of 9.8, exploitation likely requires no authentication and can be triggered simply by sending malicious SIP traffic to a network segment being monitored by a vulnerable sngrep instance, potentially yielding remote code execution with the privileges of the monitoring process. Organizations that deploy sngrep on bastion hosts, SOC workstations, or NOC servers for VoIP/SIP traffic analysis are at risk of full host compromise. If such hosts also run AI agent orchestration tools, RAG pipelines, or hold credentials/API keys for agent frameworks (common on shared ops/monitoring infrastructure), a successful RCE could pivot to steal agent secrets or manipulate agent tool-execution environments, making this agent-relevant in mixed-use environments.

Affected Systems

sngrep versions up to and including 1.8.4 on Linux/Unix systems used for SIP/VoIP traffic capture and analysis, particularly deployments monitoring untrusted or internet-facing SIP traffic

Indicators of Compromise

• No specific IOCs published; indicators would include anomalous SIP packets with oversized Call-ID/X-Call-ID header fields (>255 bytes) and unexpected sngrep process crashes or core dumps

Remediation Steps

1. 1

   Upgrade sngrep

   Update to a patched version of sngrep once available from the maintainers; monitor the project's GitHub repository for a fix addressing CVE-2026-90558.

2. 2

   Restrict SIP capture exposure

   Limit sngrep usage to trusted network segments and avoid running it directly against untrusted or internet-facing SIP traffic until patched.

3. 3

   Sandbox monitoring tools

   Run sngrep and similar packet-inspection tools in isolated containers or VMs with minimal privileges to limit blast radius if exploited.

4. 4

   Input validation via proxy filtering

   Deploy a SIP proxy or firewall that enforces header length limits and rejects malformed packets before they reach sngrep instances.

5. 5

   Audit co-located secrets

   Review any hosts running sngrep for stored credentials, API keys, or agent framework secrets, and rotate them if the host is deemed at risk.