CVE-2026-123805

Deferred Deferred - Pending Action

SCTP SACK Parsing Buffer Overflow in SIPSorcery

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: GitHub, Inc.

Description

SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.14, SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields from an attacker-controlled SCTP SACK chunk without checking that the corresponding entries fit the declared chunk length. A negotiated WebRTC peer can send a checksum-valid malformed SACK chunk that drives the parser beyond the 262144-byte receive buffer. The resulting IndexOutOfRangeException bypasses the recoverable ApplicationException handler in RTCSctpTransport.DoReceive, causing the generic handler to exit the dedicated receive loop and permanently terminate the SCTP association and all data channels. This issue is fixed in 10.0.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-09

Last Modified

2026-11-09

Generated

2026-11-10

AI Q&A

2026-11-10

EPSS Evaluated

N/A

NVD

CVE-2026-123805

EUVD

EUVD-2026-120398

Affected Vendors & Products

Vendor	Product	Version / Range
sipsorcery	sipsorcery	to 10.0.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-755	The product does not handle or incorrectly handles an exceptional condition.
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. The vulnerability exists in versions prior to 10.0.14 where the SctpSackChunk.ParseChunk function reads attacker-controlled fields without validating if they fit within the declared chunk length. This allows a malformed SACK chunk to exceed the receive buffer, causing an IndexOutOfRangeException that terminates the SCTP association and all data channels.

Detection Guidance

This vulnerability can be detected by monitoring for unexpected termination of SCTP associations or data channels in SIPSorcery-based applications. Check logs for IndexOutOfRangeException errors related to SctpSackChunk.ParseChunk. Ensure your SIPSorcery version is updated to 10.0.14 or later.

Impact Analysis

An attacker could exploit this to crash the WebRTC peer connection, disrupting all active data channels and terminating the SCTP association. This leads to loss of real-time communication, VoIP calls, or data transfer sessions.

Compliance Impact

This vulnerability primarily causes a denial-of-service condition by crashing SCTP associations and data channels, which could disrupt VoIP or WebRTC services. While it does not directly expose or leak data, prolonged service disruption may impact compliance with regulations like GDPR (availability of services) or HIPAA (reliable communication for healthcare data). However, the provided context does not explicitly link this issue to specific compliance violations.

Mitigation Strategies

Immediately update SIPSorcery to version 10.0.14 or later to patch the vulnerability. If updating is not possible, restrict WebRTC peer connections to trusted sources and monitor for malformed SCTP SACK chunks.

Hi! I’m here to help you understand CVE-2026-123805. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...