CVE-2025-12207
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
In Kamailio 5.5, the yyerror_at function in src/core/cfg.y (grammar rule handler) causes a null pointer dereference. The attack requires local access and manipulation of configuration files. The vulnerability's existence is questioned, and the vendor did not respond.
Risk Assessment
A local attacker could cause a denial of service via a crafted configuration. The risk is limited due to the required local access and configuration file modification.
Recommendation
Restrict local access to Kamailio servers and verify configuration file integrity. Monitor vendor information for a patch.
Other vulnerabilities in Kamailio
See all- CVE-2015-1590High
The kamcmd administrative utility and default configuration in kamailio before version 4.3.0 use the /tmp/kamailio_ctl directory.
- CVE-2015-1591High
Versions of kamailio before 4.2.0-2 have a vulnerability that allows local users to gain elevated privileges.
- CVE-2013-7426Critical
CVE-2013-7426 identifies an insecure handling of temporary files in kamailio 4.0.1, specifically concerning the /tmp/kamailio_fifo file. This may lead to unauthorized access to data.
- CVE-2026-108822Medium
A vulnerability was detected in Kamailio up to versions 6.0.7/6.1.3 in the isup_get_calling_party function of the file src/modules/sipt/ss7_parser.c in the sipt module. Manipulation of the length argument results in buffer overflow. The attack may be performed remotely.
- CVE-2026-93962High
A weakness in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1 affects the shm_malloc function in src/modules/cdp/receiver.c of the CDP Diameter Receiver component. Manipulation leads to a heap-based buffer overflow. The attack can be remote, and the exploit is public. Upgrading to 6.0.8 resolves the issue.
- CVE-2026-52023High
An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifically the pcscf_save_pending/save_pending path and security-agreement parsing in sec_agree.c:parse_sec_agree().
- CVE-2026-52022High
A vulnerability in Kamailio version 6.1.1 and earlier allows a remote attacker to cause a denial of service via the IMS P-CSCF registration handling components.
- CVE-2026-82608High
A vulnerability in Kamailio up to 5.5.0/6.0.7 in the get_4bytes function of the cxdx_avp.c file in the AVP Handler component leads to an out-of-bounds read. The attack can be performed remotely, and the exploit is publicly disclosed.
- CVE-2026-39864Medium
Kamailio before versions 6.0.5 and 5.8.7 contains an out-of-bounds read vulnerability in the auth module. A specially crafted SIP packet can cause a process crash (DoS) after successful user authentication without a database backend.
- CVE-2026-39863High
In Kamailio (formerly OpenSER and SER) prior to versions 6.1.1, 6.0.6, and 5.8.8, an out-of-bounds access vulnerability exists in the core. A remote attacker can send a specially crafted TCP packet, causing a process crash (denial of service). This affects Kamailio instances with TCP or TLS listeners.
Original NVD description (English source)
A vulnerability has been found in Kamailio 5.5. This affects the function yyerror_at of the file src/core/cfg.y of the component Grammar Rule Handler. Such manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The actual existence of this vulnerability is currently in question. This attack requires manipulating config files which might not be a realistic scenario in many cases. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS