Out-of-Bounds Read Vulnerability in OpenSIPS rtpproxy Component
CVE-2026-110679

6.9MEDIUM

Key Information:

Vendor

OpenSIPS

Status
Opensips
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110679?

A vulnerability exists in the rtpproxy component of OpenSIPS, specifically in the rtpproxy_offer and rtpproxy_answer functions. This flaw allows for an out-of-bounds read, which can potentially be exploited remotely. To mitigate the risk associated with this vulnerability, it is essential to upgrade to OpenSIPS version 3.6.9 or 4.0.2, where the issue has been addressed. Ensuring that your installation is updated is a critical step in maintaining the security of your systems.

Affected Version(s)

OpenSIPS 3.6.0

OpenSIPS 3.6.1

OpenSIPS 3.6.2

References

https://vuldb.com/vuln/419834
vdb-entrytechnical-description
https://vuldb.com/vuln/419834/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-110679
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nikola Kojic (RAS-IT)
nikolak (VulDB User)
nikolak (VulDB User)
.