CVE-2026-93962: Kamailio Heap Overflow

CVE explainers 2026-09-20 8 min read

Security Research Desk Expert reviewed

Threat intelligence · Human-verified · Updated 2026-09-20

▲ Escalation ViewOne CVE, briefed at three altitudes — skim the Brief, weigh the Impact, or work the Runbook. The way a SOC actually reads it.

CISOBrief · 30-second brief

TL;DR

CVE-2026-93962 is a high-severity, remote heap-based buffer overflow in Kamailio’s CDP Diameter Receiver.

Kamailio versions 5.8.8 and earlier, 6.0.7 and earlier, 6.1.4 and earlier, and 6.2.0-dev1 are affected.

NVD reports public exploit availability, but the vulnerability is not currently listed in CISA KEV.

Upgrade to Kamailio 6.0.8 or later and restrict Diameter access while patching.

Vulnerability at a Glance

Field	Details
CVE ID	CVE-2026-93962
Product	Kamailio CDP Diameter Receiver module
Severity	High
CVSS score	8.3
CVSS vector	Not included in the supplied NVD response
Attack vector	Network or remote exploitation is reported
Authentication required	Unknown from the supplied record
Privileges required	Unknown from the supplied record
Patch available	Yes
Fixed version	Kamailio 6.0.8
CISA KEV status	Not currently listed
Public exploit status	NVD reports that a public exploit is available

CVE-2026-93962 affects a specific Kamailio processing component rather than every Kamailio installation by default. Practical exposure depends on whether the CDP Diameter Receiver module is enabled and whether an attacker can reach the relevant Diameter-facing service.

The reported CVSS score is 8.3, but the supplied NVD response does not include the vector string. Authentication and privilege requirements should therefore not be inferred from the score alone. Defenders should treat remotely reachable affected deployments as high priority while validating the complete record and their local network exposure.

What Is CVE-2026-93962?

CVE-2026-93962 is described as a heap-based buffer overflow in the shm_malloc processing path within Kamailio’s CDP Diameter Receiver implementation. The relevant source file is:

src/modules/cdp/receiver.c

A heap-based buffer overflow occurs when processing causes data to exceed the bounds of a dynamically allocated memory region. Depending on the allocation, overwrite conditions, runtime protections, and attacker control, consequences can include a process crash, memory corruption, or potentially code execution. The supplied vulnerability record establishes the overflow and remote exploitability, but it does not establish a definitive code-execution outcome.

The affected component handles Diameter signaling, which is commonly used in telecommunications, carrier, roaming, authentication, authorization, and accounting environments. A vulnerable Kamailio instance may therefore sit on a sensitive signaling path even when it is not directly exposed to the public internet.

The precise triggering input and exploit mechanics should be confirmed against the upstream issue and fixing commits before developing a production exploit-detection signature.

The upstream references associate remediation with these commits:

38711a3e788de0130d48cb485578c482b57d9351
4f62235b6f477b649c5cc18b0c81b4e26c949b98

These references support patch verification, but a commit identifier alone should not be treated as proof that a deployed package contains the fix. Package maintainers may backport changes or apply them under a different package revision.

AnalystImpact · assess the risk

Who Is Affected?

The supplied NVD record identifies these affected Kamailio releases and development versions:

Release line	Affected versions
Kamailio 5.8	5.8.8 and earlier
Kamailio 6.0	6.0.7 and earlier
Kamailio 6.1	6.1.4 and earlier
Development line	6.2.0-dev1

The affected functionality is the CDP Diameter Receiver module. Version matching alone is not sufficient to determine practical exposure. Administrators should confirm whether the module is installed, loaded, and reachable through an interface that an untrusted or insufficiently trusted system can access.

A typical configuration review should look for module loading and Diameter listener configuration. The exact module filename and deployment layout can vary, so validate the result against the running process and package contents:

grep -RniE 'cdp|diameter|listen' /etc/kamailio /etc/kamailio* 2>/dev/null
kamctl ul show 2>/dev/null | head
ps -ef | grep '[k]amailio'

Organizations using vendor packages, container images, or internally maintained builds should also record the package version and source revision. Do not assume that a distribution package with a familiar Kamailio version has the fix unless its changelog or patch metadata confirms it.

CVSS Score Breakdown

CVE-2026-93962 has a reported CVSS score of 8.3, placing it in the high-severity category. The score indicates that the issue warrants prompt remediation, particularly where the vulnerable receiver processes traffic from external networks, partner networks, roaming peers, or other systems outside the administrative security boundary.

The full CVSS vector was not included in the supplied NVD response. Consequently, the individual components—such as attack complexity, privileges required, user interaction, scope, confidentiality impact, integrity impact, and availability impact—cannot be stated reliably here.

The record identifies remote exploitation, but remote reachability should not be incorrectly converted into claims about authentication requirements or privilege requirements.

Before publishing a formal compliance assessment, retrieve and archive the complete NVD record and compare it with the vendor or upstream advisory. Until then, organizations should use the reported 8.3 score for prioritization while avoiding an invented vector:

CVSS score: 8.3
CVSS vector: Not available in the supplied record

Exploitation Status

The NVD description states that a public exploit has been made available and could be used in attacks. This is the strongest exploitation-related fact available in the supplied research. It means defenders should assume that exploit knowledge may be accessible to attackers, even though the research did not identify a verified public proof-of-concept repository or a reliable exploit URL.

CVE-2026-93962 is not currently listed in the CISA Known Exploited Vulnerabilities catalog. There is therefore no CISA KEV date-added value, remediation deadline, required-action entry, or KEV ransomware campaign flag for this CVE at the assessment date.

KEV absence is not evidence that exploitation cannot occur. It only means CISA has not included the vulnerability in that catalog.

The available evidence does not confirm exploitation in the wild, a named threat actor, or an active ransomware campaign. The appropriate operational classification is:

Public exploit availability reported by NVD; confirmed in-the-wild exploitation not established by the supplied evidence.

ResponderRunbook · act now

How to Detect CVE-2026-93962

Detection should begin with asset and configuration discovery. Identify Kamailio hosts running the CDP Diameter Receiver, record their versions, and map the source networks permitted to reach Diameter listeners.

Review service logs for malformed or repeated Diameter requests immediately before crashes, restarts, worker termination, or changes in child-process behavior.

The research note does not provide a validated network signature or a known exploit payload. Avoid deploying an untested content signature that could block legitimate Diameter traffic or create false confidence. Instead, combine process, service, and network telemetry.

Useful host-level checks include:

# Confirm the running binary and package version
kamailio -V 2>&1
dpkg-query -W -f='${Package} ${Version}\n' 'kamailio*' 2>/dev/null
rpm -qa | grep -i kamailio 2>/dev/null

# Review recent service failures and restarts
journalctl -u kamailio --since "24 hours ago" --no-pager
journalctl -u kamailio | grep -Ei 'segfault|core dumped|failed|restart|oom|killed'

# Search configured logs for Diameter and receiver-related events
grep -RniE 'diameter|cdp|receiver|segfault|core dumped' \
  /var/log/kamailio /var/log/syslog /var/log/messages 2>/dev/null

A concrete initial SIEM query can alert on service instability associated with Diameter activity:

(service.name = "kamailio" OR process.name = "kamailio")
AND (
  message matches /segfault|core dumped|SIG(SEGV|ABRT)|heap|malloc|out of memory/i
  OR message matches /diameter|cdp|receiver/i
)

This query is a triage aid, not a CVE-specific exploit detector. Investigate correlated source IPs, request timing, packet captures, and process telemetry.

Preserve core dumps and relevant network data where policy permits, because heap corruption may terminate the process before a useful application-level error is logged. Include configuration and recovery data in the incident record, following established backup practices for critical signaling infrastructure.

Mitigation and Patching

The stated remediation is to upgrade to Kamailio 6.0.8 or later. The research note identifies 6.0.8 as sufficient to resolve the issue, but operators should prefer the latest supported Kamailio release and confirm compatibility with their modules, routing scripts, operating system, and Diameter integrations.

For source-based deployments, a controlled upgrade can be performed by checking out the fixed release and rebuilding according to the organization’s existing build process:

git fetch --tags origin
git checkout 6.0.8

# Reuse the same build configuration and module selection used in production.
make include_modules="..." cfg
make -j"$(nproc)"
sudo make install
sudo systemctl restart kamailio
kamailio -V

The placeholder module list must be replaced with the organization’s actual build configuration.

Package-based deployments should use the vendor or distribution package that contains Kamailio 6.0.8 or a documented backport of the fix. Verify the resulting package changelog, source revision, or vendor advisory rather than relying only on the displayed upstream version.

For teams coordinating emergency administrative access across telecom environments, a password manager such as 1Password can help centralize privileged credentials and reduce unsafe sharing during patching activities.

If immediate patching is not possible, restrict access to the CDP Diameter Receiver at network boundaries. Permit only approved Diameter peers, management networks, or signaling intermediaries, and remove unnecessary internet exposure.

If operationally safe, disable the CDP module until patching is complete by removing or commenting out the relevant module-loading directive in the Kamailio configuration. Validate the configuration before restarting:

# Example only: confirm the actual directive in the local configuration first
grep -Rni 'loadmodule.*cdp' /etc/kamailio

# Validate configuration before restart
kamailio -c -f /etc/kamailio/kamailio.cfg
sudo systemctl restart kamailio

Disabling the module may interrupt Diameter-dependent services, so coordinate with telecom and service owners. Network restriction is a compensating control, not a substitute for the fixed release.

Continue monitoring for crashes, malformed traffic, and unexpected process behavior until all affected systems are upgraded.

References

The primary references supplied for this assessment are the NVD-associated Kamailio repository, upstream issue, pull request, fixing commits, and release information:

The supplied assessment records that the CISA KEV lookup returned on_kev: false on 2026-09-20. Because CVSS vector details, exploit artifacts, and independently verified in-the-wild activity were not included in the available material, defenders should recheck the NVD record, upstream release information, and CISA KEV catalog during incident response and change-management reviews.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.