Kamailio CVE-2026-108822

Exploitation requires the target Kamailio server to have the optional sipt module loaded and its SIP-T/ISUP parsing functions invoked from the kamailio.cfg routing script on attacker-supplied SIP traffic - i.e., a SIP-to-SS7/ISUP interworking or gateway deployment. The specific trigger is a malformed ISUP calling/called/redirecting-party parameter whose declared length exceeds the 26-byte static buffer, which pre-6.0.8/6.1.4 code copied without validating sbparamlen against the packet length. Limiting factors: the sipt module is not loaded in default Kamailio configurations, so pure SIP proxy/registrar deployments are unaffected; impact is confined to a crash/denial of service, and no authentication is indicated by the vector (PR:N) though reachability depends on this non-default configuration.

The input CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9 (medium), but the impact metrics tell the real story: only VA:L is set, with VC:N/VI:N/VA:L and no subsequent-system impact, meaning this is a pure availability (crash/DoS) issue - not confidentiality loss or code execution, despite being a CWE-120 buffer overflow. The source evidence supports this: the overflow is of a small static char buffer (sb_s_buf[26]) during ISUP parameter parsing, and the fix adds length validation and bounded null-termination rather than addressing any control-flow hijack, so arbitrary code execution is not demonstrated by the available data. On exploitation signals the picture is low-urgency: no CISA KEV listing, no EPSS probability supplied, and no public proof-of-concept referenced (only VulDB entries and the GitHub patch) - so this is no public exploit identified at time of analysis. Net: this is a high-CVSS-looking-but-moderate-real-risk issue, and real risk is further bounded because it only affects deployments that load the optional sipt (SIP-T/SS7) module. Note the apparent tension - AV:N/PR:N implies trivial remote unauthenticated reach, yet reaching the vulnerable code in practice requires a non-default module and routing-script usage, which the base vector does not capture; treat raw reachability as conditional.

An attacker who can reach a Kamailio instance that has the sipt module loaded and is performing SIP-T/SS7 interworking sends a SIP message carrying a crafted ISUP body whose calling/called-party parameter declares an oversized length. The sipt parser (isup_get_calling_party) copies the attacker-controlled data past the fixed 26-byte static buffer, corrupting adjacent memory and crashing the server. No public exploit is identified at time of analysis, so this scenario is inferred from the description and the patch diff rather than a demonstrated PoC.