A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. (CVE-2026-82608)

The vulnerability CVE-2026-82608 affects Kamailio versions up to 5.5.0 and 6.0.7 in the AVP Handler module, specifically in the get_4bytes function within src/modules/ims_registrar_scscf/cxdx_avp.c. An attacker can remotely trigger an out-of-bounds read by manipulating input to this function. This vulnerability has been publicly disclosed, and a patch exists identified by commit abb5d60af6eefbd367bf6588c5589566b090e272. The vendor notes that version 5.5.0 is old and no longer maintained, implying users should upgrade to a maintained version with the patch applied.

Successful exploitation of this vulnerability can lead to an out-of-bounds read, potentially causing information disclosure, integrity loss, and availability impact. The CVSS 3.1 base score is 7.4, indicating a high-severity impact with network attack vector, low attack complexity, requiring low privileges but no user interaction, and with scope changed. However, the database-specific severity is marked as low. There are no known exploits in the wild at this time.

A patch correcting this vulnerability is available as identified by commit abb5d60af6eefbd367bf6588c5589566b090e272. It is advisable to apply this patch or upgrade to a maintained version of Kamailio beyond 6.0.7 that includes this fix. Since version 5.5.0 is no longer maintained, users should migrate to a supported version. Patch status is confirmed by the vendor advisory note and the commit reference.