CVE-2026-82608
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability in Kamailio up to 5.5.0/6.0.7 in the get_4bytes function of the cxdx_avp.c file in the AVP Handler component leads to an out-of-bounds read. The attack can be performed remotely, and the exploit is publicly disclosed.
Risk Assessment
A remote attack can lead to data disclosure or service crash. Since the exploit is public, the risk of exploitation is high.
Recommendation
It is recommended to apply the patch (commit abb5d60af6eefbd367bf6588c5589566b090e272) or upgrade to a newer version of Kamailio if available.
Other vulnerabilities in Kamailio
See all- CVE-2015-1590High
The kamcmd administrative utility and default configuration in kamailio before version 4.3.0 use the /tmp/kamailio_ctl directory.
- CVE-2015-1591High
Versions of kamailio before 4.2.0-2 have a vulnerability that allows local users to gain elevated privileges.
- CVE-2013-7426Critical
CVE-2013-7426 identifies an insecure handling of temporary files in kamailio 4.0.1, specifically concerning the /tmp/kamailio_fifo file. This may lead to unauthorized access to data.
- CVE-2026-52023High
An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifically the pcscf_save_pending/save_pending path and security-agreement parsing in sec_agree.c:parse_sec_agree().
- CVE-2026-52022High
A vulnerability in Kamailio version 6.1.1 and earlier allows a remote attacker to cause a denial of service via the IMS P-CSCF registration handling components.
- CVE-2026-39864Medium
Kamailio before versions 6.0.5 and 5.8.7 contains an out-of-bounds read vulnerability in the auth module. A specially crafted SIP packet can cause a process crash (DoS) after successful user authentication without a database backend.
- CVE-2026-39863High
In Kamailio (formerly OpenSER and SER) prior to versions 6.1.1, 6.0.6, and 5.8.8, an out-of-bounds access vulnerability exists in the core. A remote attacker can send a specially crafted TCP packet, causing a process crash (denial of service). This affects Kamailio instances with TCP or TLS listeners.
Original NVD description (English source)
A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."