Kamailio CVE-2025-12205

Local authenticated user access to the Kamailio system is required; unauthenticated remote exploitation is not possible per the CVSS AV:L/PR:L vector. The attacker must have write access to Kamailio configuration files or the ability to reload the configuration parser (potentially via a service interface if improperly exposed). The vulnerable code path is activated only when the configuration file parser processes malformed directives that trigger the sr_push_yy_state function in an unsafe state. Non-default configurations or specific syntactic patterns in the malformed configuration are likely required to reliably trigger the use-after-free condition, as the parser generally handles valid configurations without issue. The vulnerability is NOT exploitable against default, unmodified Kamailio installations that do not allow untrusted local users to modify configuration files. Limiting factors include: (1) requirement for local system access, (2) need for file write permissions on configuration files (not granted to unprivileged users in secure deployments), (3) likely need for configuration reload trigger (not all deployments allow dynamic reloads), and (4) high probability that exploit success is contingent on specific malformed input patterns rather than any configuration.

This vulnerability presents minimal real-world risk despite technically being a use-after-free issue. The CVSS 4.0 score of 1.9 reflects severe mitigating factors: local attack vector (AV:L) eliminates remote exploitation, authentication requirement (PR:L) limits attackers to local users with valid accounts, and impact severity is low across all CIA metrics (VC:L, VI:L, VA:L) with no scope change. The EPSS score of 0.02% (5th percentile) indicates very low probability of exploitation in practice. Critically, the vulnerability requires direct manipulation of Kamailio configuration files-a highly controlled operation in production environments where configuration is typically managed by authorized administrators through change control processes. The public disclosure notes the vendor's non-response and explicit statement that 'real existence of this vulnerability is still doubted,' suggesting potential analysis artifacts or edge-case conditions that may not manifest in normal operation. The attack vector (malformed config file parsing) and privilege requirement (local authenticated user) together create a scenario more aligned with insider threat or development/testing environment risk than production compromise. The existence of publicly available POC code (E:P per CVSS) does not materially increase risk given the exploitability constraints.

A local user with authenticated access to a Kamailio server creates or modifies the Kamailio configuration file (typically /etc/kamailio/kamailio.cfg or similar) with specially crafted syntax that triggers malformed parsing in the sr_push_yy_state function, causing the lexical analyzer to reference freed memory. This could be a system administrator with misconfigured permissions, a developer in a testing environment, or an attacker who has compromised a service account with configuration file write access. The resulting use-after-free may cause the Kamailio process to crash (denial of service) or, in optimistic exploitation scenarios, potentially leak sensitive memory or enable code execution, though the latter is constrained by modern memory protections and the low impact metrics.