Out-of-Bounds Read in OpenSIPS rtpproxy Component

OpenSIPS versions up to 3.6.8 and 4.0.1 contain a vulnerability (CVE-2026-110679) within the rtpproxy module, specifically involving the rtpproxy_offer and rtpproxy_answer functions. An unauthenticated remote attacker can trigger an out-of-bounds read by sending crafted SIP packets that interact with the RTP proxy functionality. Successful exploitation of this vulnerability may lead to a denial-of-service (DoS) condition or potential information disclosure of process memory. The issue stems from insufficient input validation when processing RTP proxy control commands. Defenders should prioritize patching OpenSIPS instances to versions 3.6.9 or 4.0.2 to remediate this vulnerability.

Impact

The vulnerability poses a high risk to telephony infrastructure relying on OpenSIPS for RTP relay services. If exploited, an attacker can crash the OpenSIPS process, causing a denial-of-service for voice and media traffic, or potentially leak sensitive information stored in the memory space accessed by the out-of-bounds read. This impact is significant for VoIP service providers and enterprise communication systems.

Recommendation

• Upgrade OpenSIPS to version 3.6.9 or 4.0.2 immediately to patch CVE-2026-110679.
• Inspect network traffic logs for malformed or unusually large RTP proxy command packets targeting OpenSIPS infrastructure.
• Restrict network access to the OpenSIPS management interfaces to trusted IP ranges to mitigate the risk of remote exploitation by unauthenticated actors.