OpenSIPS employs a string transformation, {s.b64encode}, that expands data by roughly a third. The transformation buffer limit of 64 KB is not compensated for this expansion, so an input of about 49 kB to 65 kB can overflow the buffer by up to 21 kB. The overflow writes attacker‑controlled data into an adjacent buffer used by later transformations, potentially corrupting control data and leading to remote code execution or arbitrary memory corruption. This is a classic stack-based buffer overflow (CWE‑120).

Versions 3.4.0‑beta through 3.6.5 and 4.0.0‑beta of OpenSIPS are vulnerable. The issue was fixed in 3.6.6 and 4.0.0‑rc1. All other versions not listed are assumed unaffected unless proven otherwise.

The CVSS score is 9.1, indicating high severity. No EPSS score is available and the vulnerability is not listed in CISA KEV. Exploitation requires a SIP message with a header value of roughly 50 kB or more when the routing script applies {s.b64encode} to attacker controlled input, making the attack highly dependent on deployment configuration. If the configuration applies the transformation, an off‑the‑shelf exploit can trigger the overflow and, if successful, could lead to arbitrary code execution or denial of service.