CVE-2026-54632

SIPSorcery, a C#/.NET library for WebRTC, SIP, and VoIP, fails to properly validate input in its RTP and STUN parsing paths: RTPChannel.OnRTPPacketReceived and the STUNAddressAttribute/STUNXORAddressAttribute parsing code index attacker-controlled bytes without sufficient length checks. A remote attacker who can reach or learn the advertised ephemeral RTP/ICE UDP port can send a single short RTP packet or a malformed zero-to-seven-byte STUN address attribute — including during ICE connectivity checks before DTLS or STUN MESSAGE-INTEGRITY verification — causing a non-socket exception in UdpReceiver.EndReceiveFrom that closes the channel and terminates the active RTP or WebRTC media session. No authentication or user interaction is required, but the impact is limited to availability (remote denial of service), reflected in a CVSS 3.1 base score of 7.5. Any application, SDK, or appliance that embeds a SIPSorcery release prior to 10.0.9 for SIP calling or WebRTC media is affected until it upgrades to 10.0.9. No public proof of concept is known and the flaw is not in CISA's KEV, so there is no evidence of in-the-wild exploitation.

What to do: Upgrade to SIPSorcery 10.0.9 or later in every application, SDK, or appliance that embeds the library. If immediate patching is not possible, restrict UDP access to RTP/ICE port ranges to trusted peers and networks, and monitor for abrupt mid-call session or channel terminations as a potential indicator. Vendors building on SIPSorcery should audit their dependency versions and ship patched builds to customers.