{"id":"CVE-2026-59623","kind":"vulnerability","aliases":["CVE-2026-59623"],"related":[],"title":"SIP stack: bad bounds check lets a remote message crash the process","description":"In CompareTelUris of SipAddress.cpp, there is a possible way to trigger an unhandled out of range exception and process crash due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"The CompareTelUris function in SipAddress.cpp performs an incorrect bounds check, which can trigger an unhandled out-of-range exception. An attacker who can send crafted SIP traffic can crash the process, causing denial of service.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","sip","voip"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:32+00:00","first_seen_at":"2026-11-10T20:46:15+00:00","triaged_at":"2026-11-10T20:49:35+00:00","updated_at":"2026-11-10T20:49:35+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-10T20:49:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SIP stack: bad bounds check lets a remote message crash the process","impact":"low","summary":"The CompareTelUris function in SipAddress.cpp performs an incorrect bounds check, which can trigger an unhandled out-of-range exception. An attacker who can send crafted SIP traffic can crash the process, causing denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["sip","voip"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"remote attacker crashes the process, denial of service","analyst_note":"Identify the affected product and vendor for SipAddress.cpp (likely an Android/AOSP telephony component) and its fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-59623.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000649,"input_tokens":4541,"output_tokens":390,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-59623':15A,18A 'addit':94C 'attack':43B 'bad':3A 'bound':4A,30B,82C 'caus':54B 'check':5A,31B,83C 'compareteluri':23B,59C 'could':85C 'craft':47B 'crash':10A,51B,77C 'cve':13A,16A 'denial':55B,89C 'due':78C 'except':41B,74C 'execut':95C 'exploit':104C 'function':24B 'incorrect':29B,81C 'interact':99C 'lead':86C 'let':6A 'messag':9A 'need':97C,102C 'out-of-rang':37B 'packag':19B 'perform':27B 'possibl':65C 'privileg':96C 'process':12A,53B,76C 'rang':40B,73C 'remot':8A,88C 'send':46B 'servic':57B,91C 'sip':1A,20B,48B 'sipaddress.cpp':26B,61C 'stack':2A 'traffic':49B 'trigger':34B,68C 'unhandl':36B,70C 'user':98C 'voip':21B 'way':66C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["package","sip","unknown","voip"],"campaign_type":null,"search_a":"'-2026':14A,17A '-59623':15A,18A 'bad':3A 'bound':4A 'check':5A 'crash':10A 'cve':13A,16A 'let':6A 'messag':9A 'process':12A 'remot':8A 'sip':1A 'stack':2A","search_b":"'attack':43B 'bound':30B 'caus':54B 'check':31B 'compareteluri':23B 'craft':47B 'crash':51B 'denial':55B 'except':41B 'function':24B 'incorrect':29B 'out-of-rang':37B 'packag':19B 'perform':27B 'process':53B 'rang':40B 'send':46B 'servic':57B 'sip':20B,48B 'sipaddress.cpp':26B 'traffic':49B 'trigger':34B 'unhandl':36B 'voip':21B","search_c":"'addit':94C 'bound':82C 'check':83C 'compareteluri':59C 'could':85C 'crash':77C 'denial':89C 'due':78C 'except':74C 'execut':95C 'exploit':104C 'incorrect':81C 'interact':99C 'lead':86C 'need':97C,102C 'possibl':65C 'privileg':96C 'process':76C 'rang':73C 'remot':88C 'servic':91C 'sipaddress.cpp':61C 'trigger':68C 'unhandl':70C 'user':98C 'way':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59623","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59623","severity":null,"published_at":"2026-11-10T20:19:32+00:00","modified_at":"2026-11-10T20:19:32+00:00","first_seen_at":"2026-11-10T20:46:15+00:00","fetched_at":"2026-11-10T20:46:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}