Every CVE Search/ Get API key

CVE-2026-82608

Kamailio AVP cxdx_avp.c get_4bytes out-of-bounds

5.3 MediumFix available

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.41%Up 0.2 points since Aug 31, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

Kamailio AVP cxdx_avp.c get_4bytes out-of-bounds

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."

Record
CVE-2026-82608
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C
CVSS 3.0
7.4 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C
CVSS 2.0
6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
Weakness
CWE-125, CWE-119
Updated
2026-11-02
EUVDEUVD-2026-68332 5.3

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."

Record
EUVD-2026-68332
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-cqrq-g7g6-656p 2.1

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function...

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."

Record
GHSA-cqrq-g7g6-656p
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-119
Updated
2026-11-02
NVD 2.1

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."

Record
CVE-2026-82608
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-119, CWE-125
Updated
2026-11-02
OSV 2.1

Kamailio AVP cxdx_avp.c get_4bytes out-of-bounds

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."

Record
CVE-2026-82608
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P
Weakness
CWE-119, CWE-125
Updated
2026-11-02
OSVDEBIAN-CVE-2026-82608 2.1

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."

Record
DEBIAN-CVE-2026-82608
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-82608 2.1

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."

Record
UBUNTU-CVE-2026-82608
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
kamailio
Debian:12
All versions, plus listed versions
5.6.3-25.6.4-15.7.0-15.7.2-15.7.3-1
Show 23 moreShow less
5.7.4-15.8.2-25.8.2-35.8.2-45.8.3-15.8.4-15.8.5-16.0.0-16.0.1-16.0.2-16.0.2-26.0.2-36.0.3-16.0.3-26.0.3-36.0.4-16.0.5-16.1.1-26.1.1-2.16.1.2-16.1.3-16.1.3-26.1.4-1
None known
kamailio
Debian:13
before 6.0.1-1+deb13u2, plus listed versions
6.0.1-16.0.1-1+deb13u1
6.0.1-1+deb13u2
kamailio
Debian:14
before 6.1.4-1, plus listed versions
6.0.1-16.0.2-16.0.2-26.0.2-36.0.3-1
Show 9 moreShow less
6.0.3-26.0.3-36.0.4-16.0.5-16.1.1-26.1.1-2.16.1.2-16.1.3-16.1.3-2
6.1.4-1
kamailio
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
4.3.1-2ubuntu14.3.4-1.1ubuntu14.3.4-1.1ubuntu24.3.4-1.1ubuntu2.14.3.4-1.1ubuntu2.1+esm14.3.4-1.1ubuntu2.1+esm2
None known
kamailio
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
4.4.2-3ubuntu55.0.4-1ubuntu15.1.1-1ubuntu15.1.1-1ubuntu45.1.2-1ubuntu15.1.2-1ubuntu25.1.2-1ubuntu2+esm15.1.2-1ubuntu2+esm2
None known
kamailio
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
5.2.3-1build35.2.3-1build45.3.0-25.3.1-15.3.2-1build1
Show 4 moreShow less
5.3.2-1build25.3.2-1build35.3.2-1ubuntu0.1~esm15.3.2-1ubuntu0.1~esm2
None known
kamailio
Ubuntu:22.04:LTS
All versions, plus listed versions
5.4.4-1build15.4.4-1ubuntu15.4.4-1ubuntu25.5.4-1
None known
kamailio
Ubuntu:24.04:LTS
All versions, plus listed versions
5.7.0-1build15.7.2-1build15.7.3-15.7.4-15.7.4-1build15.7.4-1build55.7.4-1build7
None known
kamailio
Ubuntu:26.10
All versions, plus listed versions
6.0.5-1ubuntu16.1.2-1ubuntu26.1.2-1ubuntu36.1.2-1ubuntu4
None known
kamailio
Ubuntu:26.04:LTS
All versions, plus listed versions
6.0.2-26.0.5-16.0.5-1build16.0.5-1ubuntu1
None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-82608 is a medium vulnerability (CVSS 5.3) in Kamailio, published August 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in kamailio 6.0.1-1+deb13u2.

References

Show 8 moreShow less
MoveEnter Open