CVE-2026-110679

EUVD-2026-101677
A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxy_offer/rtpproxy_answer of the component rtpproxy. This manipulation causes out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 and 4.0.2 is sufficient to resolve this issue. It is advisable to upgrade the affected component.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.3 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/OpenSIPS/opensips/
https://github.com/OpenSIPS/opensips/releases/tag/4.0.2
https://github.com/OpenSIPS/opensips/security/advisories/GHSA-qv9x-v8jq-434w
https://vuldb.com/cve/CVE-2026-110679
https://vuldb.com/submit/1003897
https://vuldb.com/vuln/419834
https://vuldb.com/vuln/419834/cti