CVE-2026-0826 Critical Unauthenticated Stack Buffer Overflow...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.rapid7.com/blog/post/ve-cve-2026-0826-critical-unauthenticated-stack-buffer-overflow-hp-poly-vvx-trio-voip-phones-fixed
• Blog Title: CVE-2026-0826: Critical Unauthenticated Stack Buffer Overflow in HP Poly VVX and Trio VoIP Phones
• Suggested Section: Network Services Pentesting > Pentesting VoIP > SIP / SDP ICE candidate parsing overflow; optionally cross-link from Binary Exploitation > Stack Overflow / ROP

🎯 Content Summary

Overview

Rapid7 Labs disclosed CVE-2026-0826, a critical unauthenticated stack-based buffer overflow in HP Poly VVX and Trio VoIP phones. A remote unauthenticated attacker can exploit it to obtain remote code execution as root on vulnerable devices when the non-default ICE feature is enabled. The vulnerability is classified as CWE-121: Stack-based Buffer Overflow and has CVSSv4 9.2 Critical🔧 Technical Details

Remote parser exploitation via oversized SDP attributes: A network protocol parser that copies a line-based attribute into a fixed-size stack buffer without checking the destination size can be exploited by sending an oversized attribute through the protocol's normal message format. In this case, SIP carries SDP, SDP carries an ICE a=candidate: attribute, and the parser copies the full candidate line into char buffer256[256] with memcpy(buffer256, string_line, string_line_length). Any candidate line longer than 256 bytes corrupts adjacent stack memory; because the function later returns using saved ARM registers from the same frame, the attacker can overwrite saved r4, r5, r11, and pc.

Offset discovery and register-control validation on ARM: A practical way to validate exploitability is to build a structured overflow pattern that accounts for protocol pr...

🤖 Agent Actions

Done.

Updated:

• src/network-services-pentesting/pentesting-voip/basic-voip-protocols/sip-session-initiation-protocol.md

Added:

• A new section on SDP/ICE candidate parsing as an RCE surface
• Notes on:
  • oversized a=candidate: parsing bugs in SIP-carried SDP
  • feature-gated reachability via ICE
  • ARM register-control validation
  • NX/ROP constraints when protocol input forbids null bytes
  • checking /proc/<pid>/maps for stable shared-library bases
• The Rapid7 blog link in the file’s ## References

Validation:

• Reviewed the final diff manually
• mdbook build could not be run here because mdbook is not installed (/bin/bash: mdbook: command not found)

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.rapid7.com/blog/post/ve-cve-2026-0826-critical-unauthenticated-stack-buffer-overflow-hp-poly-vvx-trio-voip-phones-fixed

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting > Pentesting VoIP > SIP / SDP ICE candidate parsing overflow; optionally cross-link from Binary Exploitation > Stack Overflow / ROP".

Repository Maintenance:

• MD Files Formatting: 974 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0