The vulnerability arises from an off‑by‑one length check in the sip_check_packet and sip_validate_packet functions when processing SIP payloads that are exactly 10 240 bytes in size. This defect allows attackers to trigger an out-of-bounds stack read. By sending specially crafted UDP or TCP SIP packets, or by supplying a malicious pcap file, an attacker can cause sngrep to crash or to expose adjacent stack bytes in the SIP fields that the program displays, potentially revealing sensitive data.

Irontec sngrep versions up to and including 1.9.0 are impacted. The flaw is located in the sngrep code base, specifically the sip.c module, and affects all users running the vulnerable binary regardless of operating system.

The CVSS score is 6.3, indicating moderate severity, and the reported attack vector is remote network exposure via SIP traffic. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, implying that mass exploitation has not yet occurred. Exploitation requires attacker control of SIP packet payloads or the ability to supply a pcap file to the vulnerable instance, leading to potential information disclosure or denial of service confined to the sngrep process only.