p PatchFirst

CVE-2026-110658

CVE-2026-110658 · Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length, causing memcmp to read past the heap buffer and crash the process.

CVSS 6.9 · Medium · EPSS 0.7%

Published
Updated

Stack: system

Affected products and versions

  • sofia-sip

    Versions
    • ≥ 0, ≤ 1.13.18: Affected (semver)

    No fix published

  • sofia-sip Debian:12

    Versions
    • 1.12.11+20110422.1+1e14eea~dfsg-6
    • 1.12.11+20110422.1+1e14eea~dfsg-6.1
    • 1.12.11+20110422.1+1e14eea~dfsg-6.1~exp1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sofia-sip Debian:13

    Versions
    • 1.12.11+20110422.1+1e14eea~dfsg-6.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sofia-sip Debian:14

    Versions
    • 1.12.11+20110422.1+1e14eea~dfsg-6.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sofia-sip Ubuntu:Pro:16.04:LTS

    Versions
    • 1.12.11+20110422.1-2ubuntu1
    • 1.12.11+20110422.1-2.1+deb10u3ubuntu0.16.04.1~esm1
    • 1.12.11+20110422.1-2.1+deb10u3ubuntu0.16.04.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sofia-sip Ubuntu:Pro:18.04:LTS

    Versions
    • 1.12.11+20110422.1-2.1
    • 1.12.11+20110422.1-2.1build1
    • 1.12.11+20110422.1-2.1+deb10u3build0.18.04.1
    • 1.12.11+20110422.1-2.1+deb10u3ubuntu0.18.04.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sofia-sip Ubuntu:20.04:LTS

    Versions
    • 1.12.11+20110422.1-2.1build1
    • 1.12.11+20110422.1-2.1+deb10u3ubuntu0.20.04.1
    • 1.12.11+20110422.1-2.1+deb10u3ubuntu0.20.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sofia-sip Ubuntu:22.04:LTS

    Versions
    • 1.12.11+20110422.1-2.1ubuntu1
    • 1.12.11+20110422.1-2.1ubuntu2
    • 1.12.11+20110422.1-2.1+deb10u3ubuntu0.22.04.1
    • 1.12.11+20110422.1-2.1+deb10u3ubuntu0.22.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sofia-sip Ubuntu:24.04:LTS

    Versions
    • 1.12.11+20110422.1+1e14eea~dfsg-4ubuntu1
    • 1.12.11+20110422.1+1e14eea~dfsg-4ubuntu2
    • 1.12.11+20110422.1+1e14eea~dfsg-6
    • 1.12.11+20110422.1+1e14eea~dfsg-6.1build1
    • 1.12.11+20110422.1+1e14eea~dfsg-6.1build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sofia-sip Ubuntu:26.10

    Versions
    • 1.12.11+20110422.1+1e14eea~dfsg-6.1build3
    • 1.12.11+20110422.1+1e14eea~dfsg-6.1ubuntu1
    • 1.12.11+20110422.1+1e14eea~dfsg-6.1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sofia-sip Ubuntu:26.04:LTS

    Versions
    • 1.12.11+20110422.1+1e14eea~dfsg-6.1build2
    • 1.12.11+20110422.1+1e14eea~dfsg-6.1build3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →