Is CVE-2026-93962 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93962 being exploited in the wild.

How severe is CVE-2026-93962?

High severity, with a CVSS score of 8.3, published 20 September 2026.

Which products and versions are affected?

Kamailio up to 5.8.8, 6.0.x before 6.0.8, 6.1.x before 6.1.5, 6.2.0-dev1.

Is there a fix for CVE-2026-93962?

A patch was published on 2026-09-20: Fix available in commits 38711a3e788de0130d48cb485578c482b57d9351 and related patches; upgrade to 6.0.8 or later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-93962 attacked?

It is attacked over the network.

Am I affected by CVE-2026-93962?

Check whether you run Kamailio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93962: Kamailio heap buffer overflow in CDP Diameter Receiver

CVE-2026-93962 · Severity: high · CVSS 8.3 · Published 2026-09-20

Kamailio, an open-source SIP server used for VoIP platforms, contains a heap-based buffer overflow in its Diameter protocol handler. A remote attacker can send a malformed Diameter message to trigger the overflow, potentially leading to code execution or service disruption. The vulnerability affects multiple recent versions and a patch is available.

Technologies: Kamailio. Vendors: Kamailio.

Quick answers

Is CVE-2026-93962 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93962 being exploited in the wild.
How severe is CVE-2026-93962?: High severity, with a CVSS score of 8.3, published 20 September 2026.
Which products and versions are affected?: Kamailio up to 5.8.8, 6.0.x before 6.0.8, 6.1.x before 6.1.5, 6.2.0-dev1.
Is there a fix for CVE-2026-93962?: A patch was published on 2026-09-20: Fix available in commits 38711a3e788de0130d48cb485578c482b57d9351 and related patches; upgrade to 6.0.8 or later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93962 attacked?: It is attacked over the network.
Am I affected by CVE-2026-93962?: Check whether you run Kamailio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in the shm_malloc function within src/modules/cdp/receiver.c of the CDP Diameter Receiver component. The vulnerability occurs when processing undersized Diameter messages: the code copies a 20-byte header without validating that the declared message length matches the allocated buffer size, allowing heap corruption. The attack is remotely triggerable over the network and does not require authentication.

Affected products

Kamailio Kamailio up to 5.8.8, 6.0.x before 6.0.8, 6.1.x before 6.1.5, 6.2.0-dev1

Timeline

2026-09-20: disclosed: Vulnerability disclosed and exploit made public
2026-09-20: patched: Fix available in commits 38711a3e788de0130d48cb485578c482b57d9351 and related patches; upgrade to 6.0.8 or later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.