The vulnerability is an unchecked read in the SCTP SACK chunk parser of SIPSorcery. An attacker can send a malformed SACK packet with inflated gap or duplicate counts that drives the parser past the 262,144‑byte receive buffer, triggering an IndexOutOfRangeException. This exception bypasses the normal exception handling and terminates the dedicated receive loop, permanently closing the SCTP association and all associated WebRTC data channels. The result is a service interruption for any client relying on those channels. The weakness is a classic out‑of‑bounds read, listed as CWE‑125, and involves untrusted header data (CWE‑755).

The issue affects any installation of the SIPSorcery library before version 10.0.14. All releases of the library shipped with this bug are vulnerable until the 10.0.14 release, which implements the proper bounds check. Users of older library versions that do not use the patched parser in RTCSctpTransport—particularly in WebRTC or VoIP applications—are at risk.

The CVSS score of 7.5 indicates a high impact Denial of Service risk. No EPSS score is available, suggesting limited publicly known exploitation data, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires a negotiated WebRTC connection with the ability to send SCTP SACK packets; thus, the attacker would need network access to the victim’s SCTP stream. Though exploitation complexity is low for a knowledgeable attacker, the lack of current exploitation data indicates a moderate to low probability of immediate malicious use.