CVE-2026-45809

CVE-2026-45809 is a stack-based buffer overflow in OpenSIPS watcherinfo XML generation. When a SIP SUBSCRIBE request arrives with an abnormally long URI in the From header, the presence module stores it without practical length limits. Later, when processing a watcherinfo (winfo) request for that presentity, the XML generation code copies the URI into a fixed-size stack buffer without bounds checking, causing overflow. The vulnerability is exploitable only when the presence.winfo module is loaded—a configuration that's common in deployments serving presence notifications but not universal. Check your opensipsctlrc or equivalent configuration: if loadmodule "presence_winfo.so" appears (uncommented), your deployment is exposed. The presence module itself requires no configuration change to trigger the bug; an attacker simply sends a SUBSCRIBE with a sufficiently large From URI to any user on your system, then requests watcherinfo for that user. The CVSS score of 8.7 reflects moderate exploitability, but the actual risk scales with deployment size: a carrier-grade system handling thousands of concurrent subscriptions becomes a high-value single-packet crash target, whereas a small PBX sees more contained exposure. More critically, treat this as a class vulnerability, not an isolated incident. The presence module stores data that flows to multiple downstream consumers—notify generation, dialog state, event routing. A bounds check in watcherinfo XML generation fixes this specific overflow point but leaves the underlying pattern intact: unbounded input accepted, fixed-buffer consumption downstream, no enforced contract between them. Audit any custom modules or scripts that consume presence data for similar assumptions about URI length. If you're running OpenSIPS 3.6.5 or earlier, upgrade to 3.6.6 immediately. If you cannot upgrade and don't require presence.winfo, unload the module as a temporary mitigation—but recognize this only removes one consumption path, not the underlying storage model.

Reviewed through automated stages and approved by a human before publication.