Kamailio 5.8.8/6.0.7/6.1.4/6.2.0-dev1 Heap Overflow in CDP Receiver (shm_malloc)
CVE-2026-93962 Published on September 20, 2026
Kamailio CDP Diameter Receiver receiver.c shm_malloc heap-based overflow
A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shm_malloc of the file src/modules/cdp/receiver.c of the component CDP Diameter Receiver. Executing a manipulation can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 6.0.8 is sufficient to resolve this issue. This patch is called 38711a3e788de0130d48cb485578c482b57d9351/4f62235b6f477b649c5cc18b0c81b4e26c949b98/4f62235b6f477b649c5cc18b0c81b4e26c949b98. You should upgrade the affected component.
Timeline
Advisory disclosed
VulDB entry created
VulDB entry last update
Weakness Types
Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
What is a Buffer Overflow Vulnerability?
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.
CVE-2026-93962 has been classified to as a Buffer Overflow vulnerability or weakness.
Products Associated with CVE-2026-93962
Want to know whenever a new CVE is published for Kamailio? stack.watch will email you.
