sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines…

CVE-2026-90558 is a stack buffer overflow in sngrep versions through 1.8.4 — the popular ncurses-based SIP call-flow viewer from Irontec. The vulnerable code paths are in SIP attribute formatting routines that copy Call-ID, X-Call-ID, and other header values into fixed 255-byte stack buffers using sprintf-style calls without length checks. A crafted SIP packet with an oversized header field triggers the overflow during packet parsing and rendering. This can cause a crash (DoS) or, with a carefully controlled payload, potentially redirect control flow for remote code execution. No patched version exists yet — 1.8.4 is the latest release as of September 2026.

The vendor CVSS of 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is technically defensible for the narrow scenario where sngrep is actively capturing live SIP traffic on an attacker-reachable network — but it massively overstates enterprise risk. sngrep is a diagnostic CLI tool, not a listening service or daemon. It is run on-demand by VoIP engineers, usually for minutes at a time during troubleshooting sessions. In a fleet of 10,000 hosts, you might have it installed on 5–20 machines and actively running on zero of them at any given moment. The 9.8 treats it like a permanently-exposed network service, which it simply is not.

Why this verdict

• Negligible fleet penetration: sngrep is a niche VoIP diagnostic utility. In a 10,000-host enterprise, it is installed on perhaps 5–20 hosts (VoIP engineers' workstations and SIP servers for troubleshooting). This alone reduces exposed population to <0.2%.
• Ephemeral runtime window: Unlike a daemon, sngrep runs only when manually invoked for debugging. The tool must be actively capturing live traffic for the attack to land. On any given day, the probability of an sngrep instance running during an attacker's packet injection window is extremely low.
• Network position requirement: The attacker must be on the same network segment as the SIP traffic being monitored — typically a voice VLAN or SIP trunk. Enterprise voice networks are segmented, and SBCs/firewalls often normalize SIP headers before they reach internal hosts.
• Modern mitigations limit RCE: Distro-packaged sngrep is compiled with stack protector, PIE, and ASLR. No public PoC demonstrates RCE — the realistic outcome is a tool crash, not host compromise.
• Role multiplier: sngrep is a diagnostic utility, not a high-value-role component. It does not serve as an identity provider, hypervisor, backup system, CI/CD component, or network edge appliance. (a) On workstations: LOW value — tool crash, engineer restarts it. (b) On SIP/PBX servers: the sngrep process is not the PBX itself (Asterisk/FreeSWITCH remain unaffected); compromise of sngrep ≠ compromise of the VoIP service. Blast radius is single-host at most. No high-value role applies — no floor override triggered.

Why not higher?

There is no active exploitation, no PoC demonstrating RCE, no KEV listing, and the tool is not a persistent service. The attack requires convergence of multiple low-probability conditions: the tool running, attacker on the voice VLAN, and bypass of modern exploit mitigations. A MEDIUM at 4.5 already accounts for the root-context risk if all stars align.

Why not lower?

The tool does typically run as root when capturing live traffic, meaning a successful exploit chain ends in root on that host. The sprintf-based overflow is mechanically simple and the crash is trivially reproducible even without a formal PoC. A complete dismissal to LOW would undercount the local privilege context and the fact that no patch exists yet.

1. Remove sngrep from production hosts — If sngrep is installed on SIP servers or PBXes for occasional troubleshooting, uninstall it. Use it only on dedicated diagnostic workstations or in offline PCAP-viewer mode. This eliminates the attack surface on any host that matters. No noisgate mitigation SLA applies (MEDIUM verdict), so fold this into your standard 365-day remediation cycle or act sooner if VoIP infra is in-scope for compliance.
2. Use sngrep only in offline PCAP mode — Run tcpdump or tshark to capture SIP traffic to a pcap file, then analyze offline with sngrep -I capture.pcap. The overflow can still trigger if the pcap contains a malicious packet, but the attacker cannot inject packets in real-time — they would need to have already compromised the capture source.
3. Grant CAP_NET_RAW instead of running as root — If live capture is required, use setcap 'CAP_NET_RAW+eip' /usr/bin/sngrep and run as an unprivileged user. This limits the blast radius of a successful exploit from root to a low-privilege user account.
4. Segment voice VLANs and enable SBC SIP normalization — Ensure SIP traffic traverses a Session Border Controller that normalizes or rejects oversized SIP headers before they reach internal segments where sngrep might be used. This blocks the malformed packet at the network edge.

Run this on each host where sngrep may be installed. Requires no special privileges — just checks the installed package version. Example: bash check_cve_2026_90558.sh

#!/usr/bin/env bash
# check_cve_2026_90558.sh
# Checks whether sngrep <= 1.8.4 is installed (all versions vulnerable)
# CVE-2026-90558: Stack buffer overflow in SIP attribute formatting
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

set -euo pipefail

VULN_CVE="CVE-2026-90558"
FIXED_VERSION="1.8.5"  # No fix released yet; placeholder for future patch

version_gte() {
  # Returns 0 if $1 >= $2 using sort -V
  [ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -n1)" = "$2" ]
}

# Detect installed sngrep
SNGREP_PATH="$(command -v sngrep 2>/dev/null || true)"

if [ -z "$SNGREP_PATH" ]; then
  # Also check package managers
  if command -v dpkg &>/dev/null && dpkg -l sngrep &>/dev/null 2>&1; then
    INSTALLED_VER=$(dpkg-query -W -f='${Version}' sngrep 2>/dev/null | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')
  elif command -v rpm &>/dev/null && rpm -q sngrep &>/dev/null 2>&1; then
    INSTALLED_VER=$(rpm -q --qf '%{VERSION}' sngrep 2>/dev/null)
  else
    echo "PATCHED — sngrep is not installed on this host ($VULN_CVE)"
    exit 0
  fi
else
  INSTALLED_VER=$("$SNGREP_PATH" -v 2>&1 | grep -ioP '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)
fi

if [ -z "${INSTALLED_VER:-}" ]; then
  echo "UNKNOWN — sngrep detected but could not determine version ($VULN_CVE)"
  exit 2
fi

echo "Installed sngrep version: $INSTALLED_VER"

if version_gte "$INSTALLED_VER" "$FIXED_VERSION"; then
  echo "PATCHED — sngrep $INSTALLED_VER >= $FIXED_VERSION ($VULN_CVE)"
  exit 0
else
  echo "VULNERABLE — sngrep $INSTALLED_VER < $FIXED_VERSION ($VULN_CVE)"
  echo "NOTE: No vendor patch exists yet. All versions through 1.8.4 are affected."
  echo "Mitigation: remove sngrep from production hosts or use offline PCAP mode only."
  exit 1
fi

Sources

1. Vulners — CVE-2026-90558
2. VulDB — CVE-2026-90558
3. Debian Bug #1147622 — sngrep CVE-2026-90558
4. irontec/sngrep GitHub — Releases
5. irontec/sngrep GitHub — Repository
6. OffSeq Threat Radar — CVE-2026-90558
7. TheHackerWire — sngrep Stack Buffer Overflow