Kamailio EUVD-2026-69414

Exploitation requires Kamailio to be deployed with the ims_registrar_pcscf module loaded - this module is specific to 3GPP IMS P-CSCF roles and is not part of standard or default Kamailio builds. The pcscf_save_pending or save_pending function must be called in the active SIP routing script, which occurs only during IMS UE REGISTER flows. Security-agreement negotiation (RFC 3329, IPSec-3gpp mechanism) must be configured and active. These combined conditions restrict real exposure to telecom carriers and IMS lab environments. No authentication is required - any host able to reach the SIP port (typically UDP/TCP 5060 or 5062) can trigger the flaw by sending a single crafted REGISTER message.

CVSS 7.5 (High) with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately captures the exposure for deployments running the affected module: a single malformed SIP packet over the network with no authentication is sufficient to crash the server. However, real-world risk is substantially narrowed by the deployment condition - the ims_registrar_pcscf module and security-agreement processing are IMS/VoLTE-specific and not present in standard Kamailio SIP proxy configurations. EPSS of 0.19% (9th percentile) reflects low current exploitation interest, consistent with the specialized target population. No CISA KEV listing and no public PoC further indicate this remains unexploited at time of analysis. For telecom operators running IMS core with Kamailio as P-CSCF, the risk is real and the fix is available upstream - priority should be high in that context. For general Kamailio deployments not using the ims_registrar_pcscf module, this CVE has no impact.

An unauthenticated attacker sends a SIP REGISTER message to the Kamailio P-CSCF SIP port containing a Security-Security header with one or more IPSec parameters (such as ealg or alg) omitted or malformed, causing parse_sec_agree() to fail partway through parsing. The error cleanup path then calls shm_free() on string pointers that were never populated (remaining NULL or uninitialized), corrupting the Kamailio shared memory pool and crashing the worker process. No public PoC has been identified, but the exact vulnerable code path and triggering condition are fully disclosed by the fix commit.