Log in Start free

Vulnerability · Published Sep 20, 2026 · Assigned by VulDB

CVE-2026-93962Kamailio CDP Diameter Receiver receiver.c shm_malloc heap-based overflow

High 8.3

In plain English

A high-severity heap buffer overflow in Kamailio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.3High
Exploit odds (30 days)0.7%top 47.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shm_malloc of the file src/modules/cdp/receiver.c of the component CDP Diameter Receiver. Executing a manipulation can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 6.0.8 is sufficient to resolve this issue. This patch is called 38711a3e788de0130d48cb485578c482b57d9351/4f62235b6f477b649c5cc18b0c81b4e26c949b98/4f62235b6f477b649c5cc18b0c81b4e26c949b98. You should upgrade the affected component.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12kamailiono fix listedDEBIAN-CVE-2026-93962
Debian:13kamailiono fix listedDEBIAN-CVE-2026-93962
Debian:14kamailio6.1.5-1DEBIAN-CVE-2026-93962
Ubuntu:22.04:LTSkamailiono fix listedUBUNTU-CVE-2026-93962
Ubuntu:24.04:LTSkamailiono fix listedUBUNTU-CVE-2026-93962
Ubuntu:26.04:LTSkamailiono fix listedUBUNTU-CVE-2026-93962
Ubuntu:26.10kamailiono fix listedUBUNTU-CVE-2026-93962

Affected products (as reported)

VendorProductVersions
n/a Kamailio 5.8.05.8.15.8.25.8.35.8.45.8.55.8.65.8.7

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C

References