Log in Start free

Vulnerability · Published Oct 27, 2025 · Assigned by VulDB

CVE-2025-12204Kamailio Configuration File rvalue.c rve_destroy heap-based overflow

Medium 5.3

In plain English

A medium-severity heap buffer overflow in Kamailio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 77.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in Kamailio 5.5. Impacted is the function rve_destroy of the file src/core/rvalue.c of the component Configuration File Handler. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This attack requires manipulating config files which might not be a realistic scenario in many cases. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12kamailiono fix listedDEBIAN-CVE-2025-12204
Debian:13kamailiono fix listedDEBIAN-CVE-2025-12204
Debian:14kamailiono fix listedDEBIAN-CVE-2025-12204
Ubuntu:22.04:LTSkamailiono fix listedUBUNTU-CVE-2025-12204
Ubuntu:24.04:LTSkamailiono fix listedUBUNTU-CVE-2025-12204
Ubuntu:25.10kamailiono fix listedUBUNTU-CVE-2025-12204
Ubuntu:26.04:LTSkamailiono fix listedUBUNTU-CVE-2025-12204
Ubuntu:26.10kamailiono fix listedUBUNTU-CVE-2025-12204

Affected products (as reported)

VendorProductVersions
n/a Kamailio 5.5

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References