Heap-based buffer overflow in Sofia-SIP - CVE-2026-116791
Published: November 9, 2026
Vulnerability identifier: #VU162590
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116791
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to corrupt heap memory and crash the hosting process, disrupting all concurrent sessions.
The vulnerability exists due to Sofia-SIP's WebSocket parser counting header bytes when unmasking a payload buffer filled to capacity, causing writes beyond its allocation. An unauthenticated remote attacker can send a crafted masked frame through an enabled ws-binding or wss-binding after a WebSocket upgrade, without SIP authentication or victim interaction.
Affected software
Sofia-SIP
How to mitigate CVE-2026-116791
Install security update from vendor's website.
Sofia-SIP - update to 1.13.18