Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-45538, is a stack buffer overflow in OpenSIPS. The GitHub advisory (GHSA-37wc-5j8j-95x3) provides a highly detailed explanation, including the exact file, function, and lines of code responsible. The core issue lies within the w_sip_to_json function in modules/sipmsgops/sipmsgops.c. This function, when called from a routing script, processes SIP message headers. It allocates a 255-byte stack buffer (hdr_name_buf) and then uses memcpy to copy the SIP header name into it. Crucially, the memcpy operation uses it->name.len as the size to copy, without any prior validation that it->name.len is less than or equal to the buffer's capacity (255 bytes). Since the SIP parser allows header names up to approximately 65000 bytes, an attacker can craft a SIP message with an oversized header name. When w_sip_to_json is invoked, this leads to memcpy writing beyond the bounds of hdr_name_buf, causing a stack buffer overflow. This overflow can corrupt critical stack data, including the saved frame pointer and return address, leading to a crash (Denial of Service) or, in environments without sufficient stack protections, Remote Code Execution. The advisory explicitly highlights the memcpy call at line 2151 and the buffer declaration at line 2118 as the points of vulnerability.
w_sip_to_jsonmodules/sipmsgops/sipmsgops.c