Vulnerability in SIPSorcery VoIP Library for C# and .NET

CVE-2026-54632

What is CVE-2026-54632?

The SIPSorcery VoIP library for C# and .NET prior to version 10.0.9 contains a vulnerability that affects the RTP channel and STUN attribute parsing functions. An attacker can exploit this vulnerability by sending crafted RTP packets or malformed STUN messages, potentially causing service interruptions without requiring authentication or user interaction. When the vulnerable functions process these untrusted bytes without appropriate length checks, they may lead to disruptions in active RTP or WebRTC sessions. Although the attacker needs to identify the ephemeral RTP/ICE port, the impact is focused on the availability of the media session, making the system prone to denial-of-service attacks. Users are advised to upgrade to version 10.0.9 or later to mitigate this issue.

References