Buffer Overflow Vulnerability in SIPSorcery VoIP Library for C# and .NET
CVE-2026-123805

7.5HIGH

Key Information:

Vendor: Sipsorcery-org
Status: Sipsorcery
Vendor: CVE Published:; 9 November 2026

🔔 Create Sipsorcery-org Vulnerability Alert

What is CVE-2026-123805?

The SIPSorcery library, used for WebRTC, SIP, and VoIP applications in C# and .NET, exhibits a vulnerability where the SctpSackChunk.ParseChunk method incorrectly processes fields from an attacker-controlled SCTP SACK chunk. This oversight allows a malicious WebRTC peer to send malformed packets that exceed the predefined buffer size of 262,144 bytes. Such an exploit triggers an IndexOutOfRangeException, bypassing the ApplicationException handler and resulting in the termination of SCTP associations and all corresponding data channels. This vulnerability has been addressed in version 10.0.14.