CVE-2025-12204: Kamailio Heap-Based Buffer Overflow

CVE-2025-12204 Overview

A heap-based buffer overflow vulnerability affects Kamailio 5.5, an open-source SIP server used for VoIP and real-time communication infrastructure. The flaw resides in the rve_destroy function within src/core/rvalue.c, part of the Configuration File Handler component. An attacker with local access and the ability to manipulate configuration files can trigger memory corruption during config parsing. The exploit has been publicly disclosed. The vendor was contacted but did not respond, and researchers have expressed doubts about the practical exploitability of the issue given the config-file precondition.

Critical Impact
Local attackers who can modify Kamailio configuration files may trigger a heap-based buffer overflow in rve_destroy, potentially corrupting memory in the SIP server process.

Affected Products

Kamailio 5.5.0
Deployments using the Configuration File Handler component
Systems where untrusted parties can influence Kamailio config files

Discovery Timeline

2025-10-27 - CVE-2025-12204 published to NVD
2025-10-27 - Initial disclosure on the OpenWall oss-security mailing list
2025-10-28 - Follow-up discussion on oss-security regarding exploitability
2025-11-02 - Additional update posted to oss-security
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12204

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer) and [CWE-787] (Out-of-bounds Write). It affects the rve_destroy routine in src/core/rvalue.c, which is responsible for tearing down rvalue expression structures parsed from Kamailio's configuration file.

Exploitation requires local access and the ability to supply or modify a Kamailio configuration file processed by the daemon. When the malformed configuration reaches rve_destroy during cleanup of parsed rvalue trees, memory is written outside the intended heap allocation. This can corrupt adjacent heap metadata or object state within the Kamailio process.

The practical attack surface is narrow. Configuration files are normally controlled by administrators, so the scenario assumes an attacker who already has write access to those files or influence over configuration generation pipelines. Community discussion on oss-security has questioned whether this represents a realistic threat model.

Root Cause

The root cause lies in improper bounds handling within rve_destroy when processing rvalue expression nodes. The function does not correctly validate structure state before performing writes during teardown, leading to an out-of-bounds heap write when specific configuration inputs are parsed.

Attack Vector

The attack vector is local. An attacker must place a crafted configuration file where Kamailio will parse it, then trigger a load or restart. The exploit has been publicly disclosed but no weaponized proof-of-concept has been distributed through recognized exploit databases.

No verified exploit code is available. See the OpenWall OSS-Security discussion and VulDB Advisory #329874 for technical details.

Detection Methods for CVE-2025-12204

Indicators of Compromise

Unexpected changes to Kamailio configuration files, including kamailio.cfg and included config fragments
Abnormal Kamailio process crashes, segmentation faults, or heap corruption messages in system logs
Unauthorized write access events on directories holding Kamailio configuration
New or modified rvalue expressions in configuration files that were not introduced through normal change control

Detection Strategies

Monitor file integrity on Kamailio configuration directories using host-based integrity monitoring
Correlate Kamailio process crashes with recent configuration file modifications
Audit user and service accounts that hold write permissions to Kamailio config paths
Review Kamailio startup and reload events for parsing errors originating from rvalue.c

Monitoring Recommendations

Enable auditd or equivalent kernel auditing on the Kamailio configuration directory
Forward Kamailio stderr and syslog output to a central logging platform for anomaly review
Track configuration deployments through version control and CI/CD, alerting on out-of-band edits
Alert on repeated Kamailio service restarts or crash-loop patterns

How to Mitigate CVE-2025-12204

Immediate Actions Required

Restrict write permissions on Kamailio configuration files to a minimal set of trusted administrators
Remove interactive shell access from any account not required to operate Kamailio
Validate all configuration changes through code review and version-controlled pipelines
Monitor upstream Kamailio releases and mailing lists for a patched version addressing rve_destroy

Patch Information

No vendor patch has been published at the time of NVD entry. The vendor did not respond to disclosure attempts, according to the advisory. Track the Kamailio project references and the OpenWall OSS-Security summary for updates. Users compiling from source should watch for changes to src/core/rvalue.c.

Workarounds

Enforce strict filesystem permissions on kamailio.cfg and all #!include fragments, limiting writes to root or a dedicated service owner
Deploy configurations through immutable images or read-only mounts where operationally feasible
Use mandatory access controls such as SELinux or AppArmor to constrain who can modify Kamailio config paths
Isolate Kamailio in a dedicated host or container with no untrusted local user access

bash

# Example: restrict Kamailio configuration file permissions
sudo chown root:kamailio /etc/kamailio/kamailio.cfg
sudo chmod 640 /etc/kamailio/kamailio.cfg
sudo chattr +i /etc/kamailio/kamailio.cfg   # optional: make immutable