CVE-2018-25356: SIPp 3.6 Local Buffer Overflow via Command-line Arguments

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-23 · updated 2026-10-06
Weakness: CWE-120

Description

SIPp 3.6 and earlier contains a local buffer overflow vulnerability in command-line argument handling that allows local attackers to crash the application or execute arbitrary code. Attackers can trigger the vulnerability by supplying oversized input to the -3pcc, -i, or -log_file parameters, causing strcpy to write beyond buffer boundaries in sipp.cpp.

Affected products

sipp: through 3.6

References

http://sipp.sourceforge.net/
https://github.com/SIPp/sipp/releases
https://www.exploit-db.com/exploits/44962
https://www.vulncheck.com/advisories/sipp-local-buffer-overflow-via-command-line-arguments

Get alerted when CVE-2018-25356 or the next vulnerability affects your stack