UBUNTU-CVE-2026-121943: Medium severity ubuntu/sngrep vulnerability

Published Nov 4, 2026

Updated

Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sipcheckpacket and sipvalidatepacket caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.

Affected Software

7 affected components

ubuntu/sngrep*

Event History

Nov 4, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to remote attack?

Systems running sngrep that process SIP traffic over UDP or TCP are exposed if an attacker can cause a crafted SIP packet to be handled. The affected scope includes sngrep through version 1.9.0.

What does an attacker need to trigger the issue?

An attacker needs to provide a crafted SIP payload that reaches the vulnerable packet-validation code, either in a UDP or TCP SIP packet. They can also trigger it by supplying a crafted pcap file for sngrep to process.

What is the likely impact of successful exploitation?

Successful exploitation can crash sngrep or disclose adjacent stack bytes in SIP fields displayed by the application. The provided impact data indicates confidentiality and availability effects, with no integrity impact.

UBUNTU-CVE-2026-121943: Medium severity ubuntu/sngrep vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to remote attack?

What does an attacker need to trigger the issue?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to remote attack?

What does an attacker need to trigger the issue?

What is the likely impact of successful exploitation?