Sofia-SIP versions up to 1.13.18 contain a heap out-of-bounds read in the msg_multipart_parse function that can be triggered by sending an INVITE with a multipart Content-Type whose boundary string exceeds the actual body length. The comparison performed by memcmp then reads past the allocated heap buffer, causing the process to crash. This flaw allows unauthenticated remote attackers to force the SIP stack to terminate, resulting in a denial-of-service of the telephony service.

The affected product is Sofia-SIP, the SIP User Agent component of FreeSWITCH. Versions through 1.13.18 are vulnerable; newer releases after this version are not affected.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of <1% shows a very low estimated exploitation probability. The vulnerability is not listed in CISA KEV, so no widespread exploitation is known. Attackers can exploit the flaw from any network scope that can reach the SIP service, and no privileged or authenticated state is required. The payload simply causes a crash; it does not arbitrarily execute code or exfiltrate data.