CVE-2026-110679

Deferred Deferred - Pending Action

Out-of-Bounds Read in OpenSIPS RTPProxy Function

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: VulDB

Description

A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxy_offer/rtpproxy_answer of the component rtpproxy. This manipulation causes out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 and 4.0.2 is sufficient to resolve this issue. It is advisable to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110679

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	OpenSIPS	3.6.0
n/a	OpenSIPS	3.6.1
n/a	OpenSIPS	3.6.2
n/a	OpenSIPS	3.6.3
n/a	OpenSIPS	3.6.4
n/a	OpenSIPS	3.6.5
n/a	OpenSIPS	3.6.6
n/a	OpenSIPS	3.6.7
n/a	OpenSIPS	3.6.8
n/a	OpenSIPS	4.0.0
n/a	OpenSIPS	4.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read issue in OpenSIPS versions up to 3.6.8 and 4.0.1. It affects the rtpproxy_offer/rtpproxy_answer function within the rtpproxy component. The flaw allows remote attackers to manipulate the system, potentially leading to unauthorized data access or system crashes.

Detection Guidance

To detect this vulnerability, check the OpenSIPS version running on your system. If it is 3.6.8 or lower or 4.0.1 or lower, the system is vulnerable. Use commands like 'opensips -v' or 'opensips -V' to check the version.

Impact Analysis

The vulnerability may allow remote attackers to read sensitive data, cause denial-of-service conditions, or execute arbitrary code on affected systems. This could lead to service disruption, data leaks, or unauthorized access to VoIP communications.

Compliance Impact

The vulnerability in OpenSIPS (CVE-2026-110679) involves an out-of-bounds read in the rtpproxy_offer/rtpproxy_answer function, which could lead to unauthorized data access or manipulation. This may impact compliance with GDPR by risking unauthorized processing of personal data and HIPAA by potentially exposing protected health information if exploited.

Mitigation Strategies

Upgrade OpenSIPS to version 3.6.9 or 4.0.2 immediately. This resolves the out-of-bounds read issue in the rtpproxy_offer/rtpproxy_answer function.

Hi! I’m here to help you understand CVE-2026-110679. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70