Null Pointer Dereference in Kamailio 5.5 by Kamailio Project
CVE-2025-12207

4.8MEDIUM

Key Information:

Vendor: Kamailio Project
Status: Kamailio
Vendor: CVE Published:; 27 October 2025

🔔 Create Kamailio Project Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-12207?

A security flaw has been discovered in Kamailio 5.5, specifically within the function yyerror_at of the src/core/cfg.y file, which is part of the Grammar Rule Handler component. This vulnerability allows an attacker to cause a null pointer dereference, leading to potential disruptions in service. The attack is restricted to local exploitation, and unfortunately, the public disclosure of the exploit has raised concerns. Although the vendor was notified regarding this vulnerability, there was no response from them, leaving users and administrators potentially exposed.

Affected Version(s)

Kamailio 5.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-12207 - Proof of Concept