CVE-2026-82608: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-82608 is an out-of-bounds read vulnerability in Kamailio's AVP Handler component, specifically in the get_4bytes() function within src/modules/ims_registrar_scscf/cxdx_avp.c (and systemically across multiple IMS modules). The flaw affects Kamailio versions 5.0 through 5.5.0 and 6.0.0 through 6.0.7. It was reported on July 9, 2026, patched on July 16, 2026, and publicly disclosed on August 31, 2026. The vulnerability carries a CVSS v3.1 base score of 7.4 (High) and a CVSS v4.0 base score of 2.1 (Low) (Github Advisory, Feedly).

The root cause is a missing length check before calling get_4bytes(avp->data.s) when parsing Unsigned32 Diameter AVPs across five IMS modules: ims_icscf, ims_auth, ims_registrar_scscf, ims_charging, and ims_qos (CWE-119/CWE-125). The get_4bytes() macro unconditionally reads four bytes (_b[0]<<24 | _b[1]<<16 | _b[2]<<8 | _b[3]) after only a NULL pointer check, without verifying that avp->data.len >= 4. A malicious Diameter peer (e.g., a rogue HSS on Cx, OCS on Ro/Gy, or PCRF on Rx) can send an answer message containing an Unsigned32 AVP (such as Experimental-Result-Code, Result-Code, CC-Time, or Validity-Time) with fewer than 4 bytes of value, causing the module to read past the declared AVP boundary. In practice, Diameter's 4-byte alignment padding often absorbs the over-read silently, but an unpadded short AVP at the end of a message buffer results in a genuine out-of-bounds read, confirmed via AddressSanitizer on a standalone reproducer (GitHub Issue, GitHub PR).

Successful exploitation allows an authenticated remote attacker with low privileges (a peered Diameter node) to trigger an out-of-bounds memory read, potentially disclosing adjacent memory contents from the Kamailio process's shared-memory pool, which may contain sensitive signaling data such as SIP registration state, session identifiers, or subscriber information. In the common case the over-read produces an incorrect integer value (a correctness/robustness defect), but in edge cases it can cause the affected IMS module to crash, disrupting VoIP/IMS services (availability impact). The vulnerability affects all Cx, Ro/Gy, and Rx Diameter transaction paths in the default configuration, meaning it is triggered on every relevant IMS transaction without special configuration (GitHub Issue, Github Advisory).

A proof-of-concept reproducer (a standalone C harness using the verbatim get_4bytes macro with AddressSanitizer) was included in the original bug report and has been publicly disclosed, confirming the read-past-boundary behavior (GitHub Issue). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be a peered Diameter node (low privilege), limiting the attack surface to IMS infrastructure operators or compromised Diameter peers (Feedly).

1. Establish Diameter Peering: Gain access to or compromise a Diameter peer that communicates with the target Kamailio IMS node — for example, a rogue or compromised HSS (Cx interface), OCS (Ro/Gy interface), or PCRF (Rx interface).
2. Trigger a Relevant IMS Transaction: Initiate a transaction that causes Kamailio to send a Diameter request and await an answer — e.g., cause a SIP REGISTER to trigger a UAR/UAA or SAR/SAA exchange on Cx, or a charged session to trigger CCR/CCA on Ro/Gy.
3. Craft a Malicious Diameter Answer: Construct a Diameter answer message containing an Unsigned32 AVP (e.g., Experimental-Result-Code AVP code 298, or Result-Code AVP code 268) with a value field shorter than 4 bytes (e.g., 1–3 bytes), optionally without the standard 4-byte alignment padding.
4. Send the Crafted Answer: Deliver the malformed Diameter answer to the Kamailio node over the established peer connection.
5. Trigger Out-of-Bounds Read: Kamailio's IMS module calls get_4bytes(avp->data.s) without checking avp->data.len, reading 1–3 bytes past the AVP value boundary, potentially disclosing adjacent memory or computing an incorrect integer value.
6. Observe Results: Monitor for incorrect IMS behavior (wrong result codes processed), service disruption, or attempt to infer memory contents from observable side effects in subsequent signaling (GitHub Issue, Github Advisory).

• Network: Diameter answer messages (UAA, LIA, MAA, SAA, CCA, AAA) from a peer containing Unsigned32 AVPs (e.g., AVP code 268 Result-Code, 298 Experimental-Result-Code, 416 CC-Time, 448 Validity-Time) with a value length field less than 4 bytes; anomalous or unexpected Diameter peer connections to the Kamailio node.
• Logs: Kamailio log entries showing unexpected or erroneous result codes parsed from Diameter answers (e.g., nonsensical large integers for Result-Code); IMS module errors or unexpected transaction failures on Cx/Ro/Gy/Rx interfaces.
• Process: Kamailio process crashes or core dumps originating from IMS module code paths (ims_registrar_scscf, ims_icscf, ims_auth, ims_charging, ims_qos); AddressSanitizer heap-buffer-overflow reports if Kamailio is compiled with sanitizers (GitHub Issue).

Apply the upstream patch commit abb5d60af6eefbd367bf6588c5589566b090e272, which adds avp->data.len < 4 checks before every get_4bytes() call across all affected IMS modules (ims_auth, ims_charging, ims_icscf, ims_ocs, ims_qos, ims_qos_npn, ims_registrar_scscf), merged into the Kamailio master branch on July 16, 2026 (GitHub PR). Users running Kamailio 5.5.0 should note that this version is no longer maintained by the vendor and should upgrade to a supported release in the 6.x series. As a network-level workaround, restrict Diameter peering to trusted, authenticated peers only and monitor for anomalous Diameter answer messages with malformed AVP lengths (Github Advisory).

The Kamailio project maintainers labeled the GitHub issue with old-version (indicating version 5.5.0 is unmaintained) and merged the fix promptly within one week of the report. The vendor explicitly noted that "[v]ersion 5.5.0 is old and not maintained anymore," directing users to upgrade. No significant broader media coverage or notable researcher commentary beyond the GitHub issue and advisory has been observed (GitHub Issue, Github Advisory).