The CVE-2026-45537 buffer overflow in OpenSIPS deserves your attention, but not for the reason the CVSS 9.1 score suggests. The real issue isn't the overflow itself — it's what sits 1024 bytes downstream in the BSS segment.
The vulnerability lives in construct_uri(), a function that concatenates attacker-controlled SIP URI username data into a fixed 1024-byte global buffer. Without bounds checking, a long username overwrites memory beyond that buffer. The critical detail: the adjacent global is disable_503_translation, a flag that controls how OpenSIPS routes SIP 503 Service Unavailable responses across the entire server instance.
This isn't random heap corruption requiring complex exploitation. It's a direct, deterministic control-plane attack. One malformed SIP INVITE with a sufficiently long username corrupts the 503 routing behavior for ALL subsequent messages on that server — no race condition, no ROP chain, no heap spraying required. The attacker doesn't need code execution; they gain routing manipulation that affects legitimate traffic.
The shared buffer between construct_uri() and contact_builder() compounds this. Any downstream component consuming contact headers operates on attacker-influenced data with no cryptographic integrity signal.
Why was this invisible? The overflow occurs in BSS memory, which bypasses stack protectors and doesn't trigger ASAN in default configurations. The bug doesn't crash — it corrupts state that manifests on different requests, creating a temporal gap between overflow and observable effect. Functions processing what were once trusted internal URIs got exposed to internet-facing attack surfaces without triggering security re-review. That's the systemic failure: context shifted, code didn't.
Prioritize patching to 3.6.6 or 4.0.0-rc1 immediately. If you run OpenSIPS in embedded or appliance contexts with long update cycles, treat this as active infrastructure exposure — the non-crashing nature means you may not have observable indicators of prior compromise. Review your SIP message ingestion logs for unusually long URI username fields as a forensic measure.