CVE-2026-90558
Critical
Description
sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.
SeverityCritical
CVSS9.8
Exploit probability—
ProductIrontec Sngrep
PublishedSep 12, 2026
First seenSep 12, 2026
Weakness typeCWE-121CWE-121
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| irontec sngrep | v ≤ 1.8.4 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.