CVE-2026-90558

sngrep, an open-source terminal tool used by VoIP administrators to capture and inspect live SIP traffic, contains stack buffer overflows (CWE-121) in its SIP attribute formatting routines: header values longer than a fixed 255-byte buffer, such as oversized Call-ID or X-Call-ID fields, are copied without adequate bounds checks. The flaw is triggered when the tool parses and renders a maliciously crafted SIP packet that traverses a network segment where sngrep is actively capturing, requiring no privileges or victim interaction beyond a running capture session. Successful exploitation can crash the tool or execute arbitrary code in the context of the analyst running it, potentially exposing the captured call traffic and SIP credentials held in that session. All deployments of sngrep through version 1.8.4 are affected. No public proof of concept or in-the-wild exploitation is known, and the CVE is not on CISA's KEV list.

What to do: Treat every sngrep release through 1.8.4 as vulnerable and plan to upgrade to the first fixed release published by the maintainers. Until a patch ships, run captures only on trusted internal segments with BPF capture filters restricted to known SIP peers (remember that internet-sourced SIP scans can carry hostile oversized headers onto monitored segments), and run sngrep under an unprivileged account to limit the impact of any code execution. Check historical capture hosts for unexplained sngrep crashes as a possible indicator of attempted exploitation.