CVE-2026-82608
Kamailio AVP cxdx_avp.c get_4bytes out-of-bounds
A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
5.3
Kamailio AVP cxdx_avp.c get_4bytes out-of-bounds
A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."
- Record
CVE-2026-82608- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C - CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C - CVSS 2.0
- 6.5
AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C - Weakness
- CWE-125, CWE-119
- Updated
- 2026-11-02
EUVDEUVD-2026-68332
5.3
A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."
- Record
EUVD-2026-68332- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cqrq-g7g6-656p
2.1
A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function...
A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."
- Record
GHSA-cqrq-g7g6-656p- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L - Weakness
- CWE-119
- Updated
- 2026-11-02
NVD
2.1
A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."
- Record
CVE-2026-82608- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-119, CWE-125
- Updated
- 2026-11-02
OSV
2.1
Kamailio AVP cxdx_avp.c get_4bytes out-of-bounds
A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."
- Record
CVE-2026-82608- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P - Weakness
- CWE-119, CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-82608
2.1
A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."
- Record
DEBIAN-CVE-2026-82608- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-82608
2.1
A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."
- Record
UBUNTU-CVE-2026-82608- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kamailioDebian:12 |
All versions, plus listed versions 5.6.3-25.6.4-15.7.0-15.7.2-15.7.3-1 Show 23 moreShow less5.7.4-15.8.2-25.8.2-35.8.2-45.8.3-15.8.4-15.8.5-16.0.0-16.0.1-16.0.2-16.0.2-26.0.2-36.0.3-16.0.3-26.0.3-36.0.4-16.0.5-16.1.1-26.1.1-2.16.1.2-16.1.3-16.1.3-26.1.4-1 |
None known |
kamailioDebian:13 |
before 6.0.1-1+deb13u2, plus listed versions 6.0.1-16.0.1-1+deb13u1 |
6.0.1-1+deb13u2 |
kamailioDebian:14 |
before 6.1.4-1, plus listed versions 6.0.1-16.0.2-16.0.2-26.0.2-36.0.3-1 Show 9 moreShow less6.0.3-26.0.3-36.0.4-16.0.5-16.1.1-26.1.1-2.16.1.2-16.1.3-16.1.3-2 |
6.1.4-1 |
kamailioUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 4.3.1-2ubuntu14.3.4-1.1ubuntu14.3.4-1.1ubuntu24.3.4-1.1ubuntu2.14.3.4-1.1ubuntu2.1+esm14.3.4-1.1ubuntu2.1+esm2 |
None known |
kamailioUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.4.2-3ubuntu55.0.4-1ubuntu15.1.1-1ubuntu15.1.1-1ubuntu45.1.2-1ubuntu15.1.2-1ubuntu25.1.2-1ubuntu2+esm15.1.2-1ubuntu2+esm2 |
None known |
kamailioUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5.2.3-1build35.2.3-1build45.3.0-25.3.1-15.3.2-1build1 Show 4 moreShow less5.3.2-1build25.3.2-1build35.3.2-1ubuntu0.1~esm15.3.2-1ubuntu0.1~esm2 |
None known |
kamailioUbuntu:22.04:LTS |
All versions, plus listed versions 5.4.4-1build15.4.4-1ubuntu15.4.4-1ubuntu25.5.4-1 |
None known |
kamailioUbuntu:24.04:LTS |
All versions, plus listed versions 5.7.0-1build15.7.2-1build15.7.3-15.7.4-15.7.4-1build15.7.4-1build55.7.4-1build7 |
None known |
kamailioUbuntu:26.10 |
All versions, plus listed versions 6.0.5-1ubuntu16.1.2-1ubuntu26.1.2-1ubuntu36.1.2-1ubuntu4 |
None known |
kamailioUbuntu:26.04:LTS |
All versions, plus listed versions 6.0.2-26.0.5-16.0.5-1build16.0.5-1ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-82608 is a medium vulnerability (CVSS 5.3) in Kamailio, published August 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in kamailio 6.0.1-1+deb13u2.
References
vuldb.com/vuln/397109
vuldb.com/vuln/397109/cti
vuldb.com/cve/CVE-2026-82608
vuldb.com/submit/892903
github.com/kamailio/kamailio/issues/4816
github.com/Kamailio/Kamailio/pull/4823
Show 8 moreShow less
github.com/Kamailio/Kamailio/commit/abb5d60af6eefbd367bf6588c5589566b090e272
github.com/kamailio/kamailio
nvd.nist.gov/vuln/detail/CVE-2026-82608
github.com/advisories/GHSA-cqrq-g7g6-656p
github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82608.json
security-tracker.debian.org/tracker/CVE-2026-82608
ubuntu.com/security/CVE-2026-82608
cve.org/CVERecord?id=CVE-2026-82608