OpenSIPS versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow vulnerability in the {s.b64encode} string transformation. The flaw exists because the size check only verifies input fits within a 64 KB buffer, but base64 encoding expands data by roughly a third, causing inputs between ~49,153 and 65,535 bytes to overflow the buffer by up to 21,844 bytes. The overflow writes attacker-controlled data into adjacent transformation buffers in memory, corrupting values used by subsequent transformations on the same SIP message. A remote attacker can exploit this by sending a SIP message with a large header value (approximately 50,000 bytes or more) when the routing script applies {s.b64encode} to attacker-controlled input. Exploitability depends on the deployment's routing configuration. The issue has been patched in versions 3.6.6 and 4.0.0-rc1.