Description

A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shm_malloc of the file src/modules/cdp/receiver.c of the component CDP Diameter Receiver. Executing a manipulation can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 6.0.8 is sufficient to resolve this issue. This patch is called 38711a3e788de0130d48cb485578c482b57d9351/4f62235b6f477b649c5cc18b0c81b4e26c949b98/4f62235b6f477b649c5cc18b0c81b4e26c949b98. You should upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-20T05:16:29.067Z",
  "pubdate": "2026-09-20T05:16:29.067Z",
  "executiveSummary": "A critical heap-based buffer overflow vulnerability has been identified within the CDP (Diameter) Diameter Receiver component of the Kamailio SIP server.\nThe vulnerability resides in the shm_malloc function located in src/modules/cdp/receiver.c.\nThis flaw allows remote, unauthenticated attackers to trigger memory corruption, potentially leading to arbitrary code execution or service disruption through a controlled heap overflow.\nThe affected software versions include all versions up to 5.8.8, 6.0.7, 6.1.4, and 6.2.0-dev1.\nDue to the public availability of exploit code, the risk to unpatched deployments is high, necessitating immediate remediation.\nThe vulnerability is remotely exploitable, requiring no prior authentication or administrative privileges to trigger the overflow condition during the processing of Diameter messages.",
  "technicalDetails": "The vulnerability exists in the CDP (Diameter) module of Kamailio, specifically within the memory allocation routines utilized in src/modules/cdp/receiver.c. The root cause is an improper handling of memory allocation sizing during the processing of Diameter messages, which leads to a heap-based buffer overflow.\nWhen the CDP receiver component parses incoming Diameter protocol messages, it invokes shm_malloc to allocate shared memory for packet data processing. In affected versions, the input validation logic fails to adequately verify the size of the data being buffered against the allocated memory block. If an attacker sends a specially crafted Diameter packet designed to exceed the allocated heap bounds, they can trigger an out-of-bounds write.\nThe exploit flow begins when an attacker sends a malicious Diameter request over the network to the Kamailio service. Because the vulnerability resides in the message receiver component, the application processes the malformed packet before it has undergone comprehensive validation. The insufficient size check during the shm_malloc operation allows the overflow of the heap buffer with attacker-supplied data.\nExploitation of this heap-based overflow can lead to the corruption of adjacent heap metadata or function pointers. By precisely controlling the data sent in the Diameter payload, an attacker may be able to manipulate the heap structure, potentially overwriting critical objects in memory. This can lead to denial-of-service conditions through application crashes or, in more severe scenarios, facilitate the execution of arbitrary machine code with the privileges of the Kamailio process.\nThis vulnerability is remotely exploitable without the need for authentication or specialized credentials. The impact is significant because the Diameter receiver is a core network-facing component, exposing the service to external threats. The presence of public exploit code lowers the barrier to entry for potential attackers, as the mechanics for triggering the overflow are already documented and weaponized.\nTechnical remediation requires applying the patch identified by hashes 38711a3e788de0130d48cb485578c482b57d9351 or 4f62235b6f477b649c5cc18b0c81b4e26c949b98, which ensures that input sizes are strictly validated before allocation occurs, effectively preventing the buffer from being overflown."
}