Log in Start free

Vulnerability · Published Aug 31, 2026 · Assigned by VulDB

CVE-2026-82608Kamailio AVP cxdx_avp.c get_4bytes out-of-bounds

High 7.4

In plain English

A high-severity out-of-bounds read in Kamailio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.4%top 64.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12kamailiono fix listedDEBIAN-CVE-2026-82608
Debian:13kamailio6.0.1-1+deb13u2DEBIAN-CVE-2026-82608
Debian:14kamailio6.1.4-1DEBIAN-CVE-2026-82608
Ubuntu:22.04:LTSkamailiono fix listedUBUNTU-CVE-2026-82608
Ubuntu:24.04:LTSkamailiono fix listedUBUNTU-CVE-2026-82608
Ubuntu:26.04:LTSkamailiono fix listedUBUNTU-CVE-2026-82608
Ubuntu:26.10kamailiono fix listedUBUNTU-CVE-2026-82608

Affected products (as reported)

VendorProductVersions
n/a Kamailio 5.05.15.25.35.45.5.06.0.06.0.1

Weakness: CWE-125, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C

References