High priorityDisclosed

Advisory · CVE-2026-93962

Kamailio Diameter receiver heap overflow, public exploit available

Kamailio's CDP Diameter receiver has a heap-based buffer overflow in shm_malloc that can be triggered remotely with a crafted message. A public exploit exists. Fixed in 6.0.8 with upstream patch commits available for other branches.

Advisory published September 20, 2026Independent summary
Vendor
Kamailio
Product
Kamailio
Identifier / CWE
CVE-2026-93962
CWE-119, CWE-122
Action timing
Immediate
ELI5

Explain it like I’m five

Kamailio's phone-switch software reads incoming network messages into a fixed-size cup. A carefully shaped message overflows the cup, and the spillover can be aimed at the computer's brain.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted Diameter message

    The attacker sends a malformed message to the CDP Diameter receiver port of a Kamailio server.

  2. 02shm_malloc overflow

    The flawed buffer handling in shm_malloc (src/modules/cdp/receiver.c) corrupts heap memory.

  3. 03Public exploit

    Exploit code has been made public, lowering the bar for weaponization.

  4. 04Crash or code execution

    The corruption can crash the service or, with a working exploit chain, execute attacker-controlled code on the server.

What happened

Kamailio, the widely deployed open-source SIP server, has a heap-based buffer overflow in the CDP Diameter receiver (shm_malloc in src/modules/cdp/receiver.c). The flaw affects versions 5.8.0 through 5.8.8, 6.0.0 through 6.0.7, 6.1.0 through 6.1.4, and 6.2.0-dev1, and it can be triggered remotely with a crafted Diameter message. A public exploit has been disclosed. The project fixed the issue in 6.0.8 and published patch commits (38711a3e, 4f62235b) for other affected branches.

What to do

  1. Upgrade Kamailio to 6.0.8, or apply the upstream patch commits to your affected branch if you run 5.8.x, 6.1.x, or the 6.2.0 development line.
  2. Restrict network access to Diameter and SIP signaling ports to trusted peers while patching.
  3. Check logs for crashes or restarts of the Kamailio process, which may indicate probing or exploitation.
  4. Treat a crashed or unexpectedly restarted signaling server as potentially compromised until investigated.

Management note

Signaling servers sit at the heart of voice and telecom infrastructure, and a remotely triggerable heap overflow with a public exploit is a bad combination there. Diameter listeners are often reachable from partner networks, so patching priority should reflect who can actually reach the vulnerable port.