CVE-2026-54632: 
C# vulnerability analysis and mitigation

CVE-2026-54632 is a remotely exploitable Denial-of-Service (DoS) vulnerability in the SIPSorcery .NET library that allows an unauthenticated attacker to terminate an active RTP or WebRTC media session by sending a single malformed UDP packet. It affects the NuGet package SIPSorcery versions 10.0.8 and earlier. The vulnerability was responsibly reported by Lokhesh Ujhoodha, first patched on June 7, 2026, and published to the GitHub Advisory Database on July 28, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

Two distinct coding flaws combine to create this vulnerability (CWE-20: Improper Input Validation; CWE-755: Improper Handling of Exceptional Conditions). First, RTPChannel.OnRTPPacketReceived read packet[1] after only verifying the packet was non-empty, causing an IndexOutOfRangeException on a 1-byte packet. Second, STUNAttribute.ParseMessageAttributes passed null or undersized values to typed attribute parsers (e.g., STUNXORAddressAttribute, STUNAddressAttribute), which then accessed attributeValue[1], AsSpan(2), and AsSpan(4) without length checks — a STUN message with an XOR-MAPPED-ADDRESS attribute of length 0–7 bytes would throw NullReferenceException, IndexOutOfRangeException, or ArgumentOutOfRangeException. Critically, the catch-all handler in UdpReceiver.EndReceiveFrom called Close() on any exception, meaning any unhandled exception anywhere in the packet pipeline (STUN, RTP, RTCP, DTLS, SRTP, TURN) resulted in a full channel teardown rather than dropping the offending packet. This condition is reachable during ICE connectivity checks — before the DTLS handshake and before any STUN MESSAGE-INTEGRITY verification (GitHub Advisory, Fix Commit).

The sole impact of this vulnerability is availability — there is no loss of confidentiality or integrity. A single small, unauthenticated UDP packet sent to the advertised RTP/ICE port is sufficient to immediately and completely terminate an active RTP or WebRTC media session. Applications built on SIPSorcery for VoIP, real-time communications, or WebRTC signaling are at risk of having all in-progress calls or media sessions abruptly dropped. Because the RTP/ICE port is shared and advertised in ICE candidates, any on-path or negotiating peer attacker can reliably trigger this condition; a blind off-path attacker faces higher difficulty as they must first discover the ephemeral port (GitHub Advisory).

1. Reconnaissance: Identify a target application using the SIPSorcery NuGet package (version ≤ 10.0.8) for RTP or WebRTC media sessions. This can be done by inspecting SDP offers/answers or ICE candidate exchanges in signaling traffic (e.g., SIP, WebSocket).
2. Obtain the RTP/ICE port: Intercept or observe the ICE candidate advertisement from the target, which publicly discloses the UDP port used for the RTP/ICE socket. An on-path attacker can capture this from signaling; a negotiating peer receives it directly.
3. Craft a malformed UDP packet: Prepare a minimal malformed packet — as small as 1 byte (e.g., 0x00) — or a STUN message with an XOR-MAPPED-ADDRESS attribute whose value length is between 0 and 7 bytes (below the required minimum).
4. Send the packet: Transmit the malformed UDP packet to the target's RTP/ICE port. No authentication or prior session state is required; the packet is processed before any DTLS handshake or STUN MESSAGE-INTEGRITY check.
5. Media session terminated: The packet triggers an unhandled exception in the receive handler, which the UdpReceiver.EndReceiveFrom catch-all converts into a Close() call, immediately tearing down the media channel and terminating the active RTP/WebRTC session (GitHub Advisory, Fix Commit).

• Network: Unexpected single-packet UDP datagrams (1–11 bytes) sent to the application's RTP/ICE port from unknown or unexpected source IPs; STUN messages with XOR-MAPPED-ADDRESS, XOR-PEER-ADDRESS, or XOR-RELAYED-ADDRESS attributes whose value length field is 0–7 bytes.
• Logs: Application logs showing IndexOutOfRangeException, ArgumentOutOfRangeException, or NullReferenceException originating from UdpReceiver.EndReceiveFrom, RTPChannel.OnRTPPacketReceived, or STUNAttribute.ParseMessageAttributes; log entries indicating unexpected channel Close events during active media sessions.
• Application Behavior: Abrupt, unexplained termination of RTP or WebRTC media sessions without a corresponding SIP BYE or normal session teardown signal; media sessions dropping immediately after ICE connectivity check phase begins.

The fix is available in SIPSorcery NuGet package version 10.0.9, released June 7, 2026. Upgrading to 10.0.9 is the only complete remediation. The patch changes UdpReceiver.EndReceiveFrom to log and drop malformed packets rather than closing the channel, adds a minimum packet length check (RTPHeader.MIN_HEADER_LEN) in RTPChannel.OnRTPPacketReceived, and adds attribute value length validation throughout STUN parsing. No in-library workaround exists for older versions; however, restricting the RTP/ICE UDP port to known peer IP addresses at the network/firewall layer reduces exposure without fully eliminating it, since a negotiating peer can still trigger the condition (GitHub Advisory, Fix Commit).

The vulnerability was responsibly disclosed by security researcher Lokhesh Ujhoodha and acknowledged by the SIPSorcery maintainer, who merged the fix on June 7, 2026, with a note that the DoS vector was systemic across the entire packet pipeline. No significant broader media coverage or notable community commentary beyond the GitHub advisory and pull request has been identified (GitHub PR #1677, GitHub Advisory).