Quick answers
- Is CVE-2026-82608 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82608 being exploited in the wild.
- How severe is CVE-2026-82608?
- High severity, with a CVSS score of 7.4, published 31 August 2026.
- Which products and versions are affected?
- Kamailio 5.5.0 and 6.0.7 and prior.
- Is there a fix for CVE-2026-82608?
- A patch was published on 2026-07-16: Patch merged via PR #4823 on July 16, 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82608 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-82608?
- Check whether you run Kamailio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an out-of-bounds read in the get_4bytes() function within the ims_registrar_scscf module's cxdx_avp.c component, which handles AVP (Attribute-Value Pair) parsing in the IMS (IP Multimedia Subsystem) registrar. The root cause is insufficient length validation before reading 4-byte values from network packets, allowing attackers to read memory beyond allocated buffers. The vulnerability is network-reachable and requires no authentication; a remote attacker can craft malicious SIP messages to trigger the out-of-bounds read. Exploitation results in information disclosure and potential denial of service. Patch abb5d60af6eefbd367bf6588c5589566b090e272 adds length checks before calling get_4bytes() and has been merged into the main branch.
Affected products
- Kamailio Kamailio 5.5.0 and 6.0.7 and prior
Timeline
- 2026-08-31: disclosed
- 2026-07-16: patched: Patch merged via PR #4823 on July 16, 2026