Heap-Based Buffer Overflow Vulnerability in Kamailio SIP Server
CVE-2026-93962

6.9MEDIUM

Key Information:

Vendor: Kamailio
Status: Kamailio
Vendor: CVE Published:; 20 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-93962?

A vulnerability has been discovered in the Kamailio SIP Server specifically in the CDP Diameter Receiver module, affecting versions up to 5.8.8, 6.0.7, 6.1.4, and the 6.2.0-dev1 branch. The flaw resides in the shm_malloc function located in the source file src/modules/cdp/receiver.c, which can be exploited by an attacker to achieve a heap-based buffer overflow. This security issue permits remote manipulation, making it a serious risk for systems utilizing affected versions. Users are urged to upgrade to version 6.0.8 or later, where this vulnerability has been patched, ensuring enhanced protection against potential exploitation.

Affected Version(s)

Kamailio 5.8.0

Kamailio 5.8.1

Kamailio 5.8.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-93962 - Proof of Concept