CVE-2026-0794 identifies a use-after-free vulnerability (CWE-416) in the ALGO 8180 IP Audio Alerter, a device used for IP-based audio alerting and paging. The vulnerability exists in the SIP call handling component, where the software fails to verify the existence of an object before operating on it, leading to a use-after-free condition. This memory corruption flaw can be triggered remotely by sending specially crafted SIP messages to the device. Exploiting this vulnerability allows an unauthenticated attacker to execute arbitrary code within the device's context, potentially gaining full control. The CVSS v3.0 score is 8.1, reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability was reported by ZDI (ZDI-CAN-28303) and published on January 23, 2026. No patches or known exploits are currently available, increasing the urgency for defensive measures. The affected version is 5.5 of the ALGO 8180 IP Audio Alerter. Given the device's role in critical communication systems, exploitation could disrupt alerting services or enable attackers to use the device as a foothold within a network.

For European organizations, this vulnerability poses significant risks, especially for those relying on ALGO 8180 devices in security, emergency alerting, or communication infrastructures. Successful exploitation can lead to unauthorized access, manipulation, or disruption of alerting systems, potentially causing operational outages or misinformation during critical events. Confidentiality breaches could expose sensitive communication data, while integrity and availability impacts could undermine trust in alerting mechanisms. The lack of authentication requirement lowers the barrier for attackers, increasing the likelihood of remote exploitation. This threat could affect public safety agencies, transportation hubs, corporate campuses, and other sectors where IP audio alerting is integral. Additionally, compromised devices could serve as entry points for lateral movement within organizational networks, amplifying the overall security risk.

Until an official patch is released by ALGO, European organizations should implement strict network-level controls to mitigate this vulnerability. This includes deploying SIP-aware firewalls and intrusion prevention systems to detect and block malformed SIP traffic targeting the 8180 devices. Network segmentation should isolate these devices from general user networks and limit exposure to untrusted sources. Monitoring and logging SIP traffic for anomalies can provide early detection of exploitation attempts. Organizations should also review and harden device configurations, disabling unnecessary services and restricting management interfaces. Engaging with ALGO support for any available interim fixes or guidance is recommended. Finally, organizations should prepare for rapid deployment of patches once available and conduct thorough post-patch testing to ensure vulnerability remediation.