CVE-2026-93962

Kamailio CDP Diameter Receiver receiver.c shm_malloc heap-based overflow

State: Published
Severity: 6.9 Medium
Published: Sep 20, 2026
Updated: Sep 22, 2026
Reserved: Sep 19, 2026

Description

A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shm_malloc of the file src/modules/cdp/receiver.c of the component CDP Diameter Receiver. Executing a manipulation can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 6.0.8 is sufficient to resolve this issue. This patch is called 38711a3e788de0130d48cb485578c482b57d9351/4f62235b6f477b649c5cc18b0c81b4e26c949b98/4f62235b6f477b649c5cc18b0c81b4e26c949b98. You should upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P	VulDB
3.1	8.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	8.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-122 Heap-based Buffer Overflow
CWE-119 Memory Corruption

Affected Products

Product	Versions
Kamailion/a	5.8.0Affected 5.8.1Affected 5.8.2Affected 5.8.3Affected 5.8.4Affected 5.8.5Affected 5.8.6Affected 5.8.7Affected 5.8.8Affected 6.0.0Affected 6.0.1Affected 6.0.2Affected 6.0.3Affected 6.0.4Affected 6.0.5Affected 6.0.6Affected 6.0.7Affected 6.1.0Affected 6.1.1Affected 6.1.2Affected 6.1.3Affected 6.1.4Affected 6.2.0-dev1Affected 6.0.8Not affected

References

VDB-407921 | Kamailio CDP Diameter Receiver receiver.c shm_malloc heap-based overflowvdb-entrytechnical-description
VDB-407921 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-93962 | CVE Analysis and Reportthird-party-advisory
Submit #944244 | Kamailio Kamailio SIP Server 6.1.4 Heap-based Buffer Overflowthird-party-advisory
https://github.com/kamailio/kamailio/issues/4876exploitissue-tracking
https://github.com/kamailio/kamailio/pull/4877issue-trackingpatch
https://github.com/kamailio/kamailio/commit/38711a3e788de0130d48cb485578c482b57d9351patch
https://github.com/kamailio/kamailio/releases/tag/6.0.8patch
https://github.com/kamailio/kamailio/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.