CVE-2026-82608: Out-of-Bounds Read in Kamailio

Kamailio versions up to 5.5.0 and 6.0.7 contain an out-of-bounds read vulnerability in the get_4bytes function of the AVP Handler module (src/modules/ims_registrar_scscf/cxdx_avp.c). This vulnerability can be exploited remotely by manipulating inputs to cause memory reads outside the intended buffer bounds. The vulnerability has been publicly disclosed, and a patch exists identified by commit abb5d60af6eefbd367bf6588c5589566b090e272. The vendor notes that version 5.5.0 is old and no longer maintained, implying users should upgrade to a maintained version with the patch applied.

Successful exploitation of this vulnerability may lead to out-of-bounds memory reads, potentially exposing sensitive information or causing application instability. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and privileges. The CVSS 4.0 score rates it as medium severity, indicating a moderate risk to affected systems.

A patch addressing this vulnerability is available as identified by commit abb5d60af6eefbd367bf6588c5589566b090e272. It is recommended to apply this patch or upgrade to a maintained version of Kamailio that includes this fix. Note that version 5.5.0 is no longer maintained, so upgrading beyond this version is advisable. No vendor advisory explicitly states that no action is required or that the issue is already mitigated, so patching is the recommended mitigation.