CVE-2026-54632: 
C# vulnerability analysis and mitigation

CVE-2026-54632 is a Denial-of-Service (DoS) vulnerability in the SIPSorcery .NET library that allows a remote, unauthenticated attacker to terminate an active RTP or WebRTC media session by sending a single malformed UDP packet. It affects the NuGet package SIPSorcery versions 10.0.8 and earlier. The vulnerability was responsibly reported by Lokhesh Ujhoodha, first patched on June 7, 2026, and published to the GitHub Advisory Database on July 28, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, SIPSorcery Advisory).

Two root causes combine to create this vulnerability (CWE-20: Improper Input Validation; CWE-755: Improper Handling of Exceptional Conditions). First, RTPChannel.OnRTPPacketReceived read packet[1] after only verifying the packet was non-empty, causing an IndexOutOfRangeException on a 1-byte packet. Second, STUNAttribute.ParseMessageAttributes passed null or undersized values to typed attribute parsers — specifically STUNXORAddressAttribute and STUNAddressAttribute — which then accessed attributeValue[1], AsSpan(2), and AsSpan(4) without length checks, throwing NullReferenceException or IndexOutOfRangeException for STUN attributes with value lengths of 0–7 bytes. Critically, the catch-all handler in UdpReceiver.EndReceiveFrom called Close() on any exception, meaning any unhandled exception anywhere in the packet pipeline (STUN, RTP, RTCP, DTLS, SRTP, TURN) resulted in a full channel teardown rather than dropping the offending packet. This is exploitable during ICE connectivity checks — before the DTLS handshake and before any STUN MESSAGE-INTEGRITY verification — making it reachable by unauthenticated parties (GitHub Advisory, Fix Commit).

The impact is limited to availability — there is no loss of confidentiality or integrity. A single small, unauthenticated UDP packet sent to the advertised RTP/ICE port is sufficient to immediately terminate an active RTP or WebRTC media session, causing a complete disruption of voice, video, or data communications relying on the affected library. Applications built on SIPSorcery for VoIP or WebRTC are at risk of having all active media sessions disrupted by any network-reachable attacker who can identify the ephemeral RTP/ICE port (GitHub Advisory, SIPSorcery Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-54632. The vulnerability is trivially exploitable in concept — a single 1-byte UDP packet is sufficient — but an off-path attacker must first discover the ephemeral RTP/ICE port, which reduces blind exploitation risk. A peer or on-path attacker who can observe ICE candidate advertisements has direct access to the port. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry has been identified at this time (GitHub Advisory).

1. Reconnaissance: Identify a target application using the SIPSorcery NuGet package (version ≤ 10.0.8) for RTP or WebRTC media sessions. This may be discoverable through SDP offer/answer exchanges or ICE candidate advertisements in signaling traffic.
2. Obtain the RTP/ICE port: Intercept or observe the ICE candidate list shared during session negotiation (e.g., via SIP signaling or WebRTC offer/answer), which advertises the ephemeral UDP port used for RTP/ICE. An on-path attacker can observe this directly; an off-path attacker must infer or scan for the port.
3. Craft a malformed UDP packet: Prepare a minimal malformed packet — as small as 1 byte (e.g., 0x00) — or a STUN message with an XOR-MAPPED-ADDRESS attribute whose value length is 0–7 bytes (below the required 8 bytes for an IPv4 address).
4. Send the packet: Transmit the malformed UDP packet to the target's RTP/ICE port. No authentication, credentials, or prior session state is required. This is possible during ICE connectivity checks, before DTLS handshake or STUN MESSAGE-INTEGRITY verification.
5. Session termination: The malformed packet triggers an unhandled exception (IndexOutOfRangeException, NullReferenceException, or ArgumentOutOfRangeException) in the packet receive handler, which the UdpReceiver.EndReceiveFrom catch-all converts into a Close() call, immediately tearing down the media channel and terminating the session (GitHub Advisory, Fix Commit).

• Network: Unexpected single small UDP packets (1–7 bytes) sent to the application's RTP/ICE port from unknown or unexpected source IPs; sudden loss of RTP/WebRTC media sessions coinciding with receipt of anomalous UDP traffic.
• Logs: Application log entries containing IndexOutOfRangeException, NullReferenceException, or ArgumentOutOfRangeException originating from UdpReceiver.EndReceiveFrom, RTPChannel.OnRTPPacketReceived, or STUNAttribute.ParseMessageAttributes; log messages indicating unexpected channel closure ("Exception UdpReceiver.EndReceiveFrom") without a corresponding socket error.
• Process/Application Behavior: Abrupt termination of active RTP or WebRTC media sessions without user action or network-level disconnection; repeated media session drops that correlate with inbound UDP traffic from a specific source (GitHub Advisory, Fix Commit).

The fix is available in SIPSorcery version 10.0.9 (NuGet). Upgrading to 10.0.9 is the only complete remediation; there are no in-library workarounds. As a partial network-layer mitigation, restricting the RTP/ICE port to known peer IP addresses reduces exposure but does not fully eliminate the risk, since a negotiating peer can still trigger the condition. The fix changes UdpReceiver.EndReceiveFrom to log and drop malformed packets rather than closing the channel, adds a minimum packet length check (RTPHeader.MIN_HEADER_LEN) in RTPChannel.OnRTPPacketReceived, and adds attribute value length validation throughout STUN parsing (GitHub Advisory, SIPSorcery Advisory).

The vulnerability was responsibly disclosed by Lokhesh Ujhoodha (GitHub: @Lougarou) and acknowledged by the SIPSorcery maintainer, who merged the fix on June 7, 2026, with a note that the behavior was "a potential DoS vector." No significant broader media coverage or notable researcher commentary beyond the GitHub advisory and pull request has been identified (SIPSorcery PR #1677).