MGASA-2026-0587: Updated sofia-sip package fixes a security vulnerability
Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msgmultipartparse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length, causing memcmp to read past the heap buffer and crash the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mageia/sofia-sipto a version that resolves this vulnerability.Fixed in 1.13.19-1.mga10
Event History
Frequently Asked Questions
What network exposure is required for exploitation?
An attacker needs to be able to send a SIP INVITE request to a process using the affected Sofia-SIP multipart parser. No authentication is required.
What input triggers the crash?
The INVITE must use a multipart Content-Type with a MIME boundary larger than the message body length. This causes msg_multipart_parse() to read beyond a heap buffer during a memcmp operation.
What is the known impact?
The documented impact is a remote process crash, which can cause denial of service.