Quick answers
- Is CVE-2026-52022 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-52022 being exploited in the wild.
- How severe is CVE-2026-52022?
- High severity, with a CVSS score of 7.5, published 1 September 2026.
- Which products and versions are affected?
- Kamailio 6.1.1 and before.
- Is there a fix for CVE-2026-52022?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-52022 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-52022?
- Check whether you run Kamailio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a use-after-free / double-free memory corruption issue in the ims_usrloc_pcscf module's REGISTER reply handling path, specifically during IPSec negotiation in the free_security() function. The defect occurs when overlapping or high-rate registration transactions trigger abnormal state handling in the IMS contact management code. The attack is network-accessible and requires no authentication; an attacker can send specially crafted or high-frequency SIP REGISTER messages to induce a segmentation fault (SIGSEGV) in the P-CSCF worker process. The root cause is a missing check to prevent double memory free when certain transaction states coincide. A fix has been released via commit 91c5ca7, which adds checks in the free_security() method to prevent the double-free condition.
Affected products
- Kamailio Kamailio 6.1.1 and before
Timeline
- 2026-09-01: disclosed
- other: Double-free bug fixed in commit 91c5ca7