Description

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to implement a patch to correct this issue. The vendor points out, that "[v]ersion 5.5.0 is old and not maintained anymore."

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-31T03:16:43.293Z",
  "pubdate": "2026-08-31T03:16:43.293Z",
  "executiveSummary": "A critical out-of-bounds read vulnerability has been identified in the Kamailio AVP Handler component, specifically within the ims_registrar_scscf module.\nThe vulnerability resides in the get_4bytes function located in src/modules/ims_registrar_scscf/cxdx_avp.c, affecting versions up to 5.5.0 and 6.0.7.\nThis flaw permits a remote attacker to trigger memory access violations, which may result in information disclosure or process instability.\nBecause the vulnerability is exploitable remotely and proof-of-concept exploits have been publicly disclosed, the risk profile is elevated.\nThe vendor has explicitly noted that version 5.5.0 is end-of-life and no longer receives security maintenance, necessitating an urgent upgrade to a supported, patched version.\nThe vulnerability does not necessarily require local access or high-level privileges, as the attack vector originates from network-accessible interfaces that interact with AVP processing logic.",
  "technicalDetails": "The root cause of the vulnerability is an insufficient boundary check within the get_4bytes function in the src/modules/ims_registrar_scscf/cxdx_avp.c file. This function is responsible for parsing AVP (Attribute-Value Pair) data structures, which are integral to the IMS (IP Multimedia Subsystem) signaling processed by Kamailio.\nDuring the processing of malformed or maliciously crafted CX/DX AVP payloads, the function fails to validate that the input buffer length is sufficient to accommodate a 4-byte read operation. When a specially crafted packet is sent to the target, the function attempts to read 4 bytes beyond the allocated buffer boundaries.\nThe attack flow initiates with the transmission of a crafted SIP/Diameter message containing a manipulated AVP structure to a Kamailio instance running the vulnerable ims_registrar_scscf module. Upon receipt, the AVP Handler invokes get_4bytes to extract data fields. Due to the lack of adequate length verification, the pointer arithmetic used to access the data drifts into adjacent memory regions.\nThe exploitation of this out-of-bounds read leads to the leakage of memory contents that may contain sensitive information, such as cryptographic keys, session tokens, or other session-related data residing in the heap or stack memory of the Kamailio process. Furthermore, depending on the memory layout and the state of the process, repeated exploitation or specific triggering conditions may lead to an application crash, resulting in a denial-of-service (DoS) condition.\nBecause the attack is performable from a remote source and the vulnerability mechanism is intrinsic to the parsing logic of the AVP Handler, the threat is accessible to any remote entity capable of sending Diameter/SIP traffic that reaches the vulnerable logic. Public disclosure of the exploit code significantly lowers the barrier for attackers to weaponize this memory safety issue.\nThe vulnerability is addressed in patch abb5d60af6eefbd367bf6588c5589566b090e272, which reinforces boundary checking mechanisms within the get_4bytes function to ensure that memory read operations strictly adhere to allocated buffer sizes."
}