CVE-2026-110658: Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse
Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msgmultipartparse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length, causing memcmp to read past the heap buffer and crash the process.
Affected Software
Event History
Frequently Asked Questions
What traffic must reach the affected process for exploitation to be possible?
An attacker must be able to send an unauthenticated SIP INVITE to the affected process. The INVITE must use a multipart Content-Type with a MIME boundary longer than the message body.
What is the expected impact of successful exploitation?
Successful exploitation causes msg_multipart_parse() to read beyond a heap buffer during memcmp and crash the process. The provided information describes a denial-of-service impact, with no confidentiality or integrity impact indicated.
Are unauthenticated deployments exposed?
Yes. The issue is described as exploitable by unauthenticated remote attackers, so authentication is not required before sending the malicious INVITE.