Kamailio CVE-2026-82608

Exploitation requires the ability to send crafted Diameter protocol messages to the Kamailio IMS Cx/Dx interface. In standard IMS deployments, Diameter peers are trusted network entities (HSS, I-CSCF, S-CSCF) and Diameter traffic is typically segregated from public networks, meaning exploitation from the open internet requires prior compromise of a Diameter peer or a network segmentation failure. The CVSS 4.0 vector (PR:L) confirms that some level of network-layer or application-layer authentication is required - unauthenticated exploitation from arbitrary internet addresses is not the standard threat model. Additionally, the flaw is triggered only when IMS-specific modules are loaded (ims_auth, ims_icscf, ims_registrar_scscf, ims_charging, ims_ocs); Kamailio deployments running only as a base SIP proxy without these modules are not exposed through this code path. Exploitation is limited in impact to memory disclosure or process crash - code execution from an out-of-bounds read alone is not the expected outcome.

The CVSS 4.0 base score of 2.1 accurately reflects a low-severity vulnerability with network reach but constrained impact: confidentiality, integrity, and availability are all rated Low, and exploitation requires low-privilege access. The out-of-bounds read class (CWE-125) is generally not exploitable for arbitrary code execution, limiting real-world impact to memory disclosure or process instability. EPSS data was not provided in the available intelligence, so probabilistic exploitation likelihood cannot be formally quantified. The absence from CISA KEV indicates no confirmed widespread active exploitation at time of analysis, though the E:P threat metric in the CVSS 4.0 vector confirms a publicly available exploit, which lowers the skill barrier for targeted attacks. The principal risk amplifier here is the vendor's explicit end-of-life declaration for version 5.5.0 - operators on that branch will never receive a security fix through the vendor channel and must self-apply the upstream patch or migrate to the maintained 6.x line. The vulnerability is further scoped to Kamailio deployments with IMS modules loaded; base SIP proxy deployments that do not load the affected modules are not exposed through this specific code path.

An attacker with network access to the Kamailio Diameter interface - such as through a compromised Diameter peer, a rogue HSS node, or inadequately segmented IMS network access - sends a Cx/Dx Diameter message containing an AVP with fewer than 4 bytes of payload data. The get_4bytes() function reads 4 bytes regardless of actual AVP length, accessing memory beyond the allocated buffer and potentially exposing adjacent heap contents or triggering a segmentation fault. A public proof-of-concept is referenced at https://github.com/kamailio/kamailio/issues/4816.