CVE-2025-12205: 
Linux Debian vulnerability analysis and mitigation

A use-after-free vulnerability was identified in Kamailio 5.5, specifically in the srpushyy_state function of the Configuration File Handler (src/core/cfg.lex). The vulnerability was disclosed on October 27, 2025, and has been assigned CVE-2025-12205. The vulnerability's existence is currently disputed, as it requires local access and manipulation of configuration files, which may not represent a realistic attack scenario (VulDB Entry, OSS Security).

The vulnerability is classified as a use-after-free (CWE-416) issue in the configuration file parsing mechanism. It received a CVSS v3.1 base score of 7.8 (High) from NVD and 5.3 (Medium) from VulDB, with a CVSS v4.0 score of 4.8 (Medium). The vulnerability requires local access and low privileges to exploit. The attack vector involves manipulating configuration files that handle import/include functionality, potentially leading to reading freed memory during configuration parsing (VulDB Entry).

If successfully exploited, the vulnerability could affect system confidentiality, integrity, and availability. The primary impact would be a process crash at startup, resulting in a Denial of Service condition. There's also potential for memory corruption that could be leveraged for further exploitation (VulDB Entry).

No specific mitigation strategies have been officially documented. The vendor was contacted about the disclosure but has not responded with patches or workarounds. The Kamailio project is currently reviewing the vulnerability claim and is likely to dispute its validity (OSS Security).

The security community has expressed skepticism about the severity and validity of this vulnerability. The Kamailio project team has indicated they were not aware of these CVEs until they were publicly disclosed and have questioned their legitimacy. Security researchers have noted that the attack scenario is unrealistic, as having configuration file access would already grant significant control over the system (OSS Security).