Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-123805— SIPSorcery: Unbounded SCTP SACK gap/duplicate counts cause out-of-bounds read that kills the data-channel receive thread (DoS)

Quick assessment

Affected
sipsorcery-org sipsorcery
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SIPSorcery 是一个面向 C和 .NET 平台的 WebRTC、SIP 及 VoIP 库。在 10.0.14 版本之前， 方法会从攻击者控制的 SCTP SACK 数据块中读取 和 字段，但未验证这些字段对应的条目是否适配声明的数据块长度。经过协商的 WebRTC 对等端可发送一个校验和有效但结构畸形的 SACK 数据块，迫使解析器超出 262144 字节的接收缓冲区。由此引发的 会绕过 中可恢复的 处理器，导致通用异常处理器退出专用的接收循环，进而永久终止 SCTP 关联及其所有数据通道。该问题已在 10

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-123805

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SIPSorcery: Unbounded SCTP SACK gap/duplicate counts cause out-of-bounds read that kills the data-channel receive thread (DoS)
Source: CVE Program / CVE List V5
Vulnerability Description
SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.14, SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields from an attacker-controlled SCTP SACK chunk without checking that the corresponding entries fit the declared chunk length. A negotiated WebRTC peer can send a checksum-valid malformed SACK chunk that drives the parser beyond the 262144-byte receive buffer. The resulting IndexOutOfRangeException bypasses the recoverable ApplicationException handler in RTCSctpTransport.DoReceive, causing the generic handler to exit the dedicated receive loop and permanently terminate the SCTP association and all data channels. This issue is fixed in 10.0.14.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sipsorcery-org sipsorcery < 10.0.14 -

II. Public POCs for CVE-2026-123805

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-123805

请登录查看更多情报信息。

Other References for CVE-2026-123805 (3)

IV. Related Vulnerabilities

Same product: sipsorcery
Same vendor: sipsorcery-org
Same weakness: CWE-125