CVE-2026-108822: Kamailio Buffer Overflow Vulnerability

CVE-2026-108822 Overview

CVE-2026-108822 is a buffer overflow vulnerability in Kamailio, an open-source SIP (Session Initiation Protocol) server widely deployed for VoIP infrastructure. The flaw resides in the isup_get_calling_party function within src/modules/sipt/ss7_parser.c, part of the sipt module that parses ISUP (ISDN User Part) messages for SS7 interworking. Manipulation of the length argument triggers a buffer overflow condition classified under [CWE-119]. The vulnerability affects Kamailio versions up to 6.0.7 and 6.1.3, and can be exploited remotely over the network without authentication.

Critical Impact
Remote attackers can trigger a buffer overflow in the Kamailio sipt module parser, affecting availability of SIP-SS7 gateway services.

Affected Products

Kamailio versions up to and including 6.0.7
Kamailio versions up to and including 6.1.3
Deployments using the sipt module for SIP-to-SS7 interworking

Discovery Timeline

2026-10-12 - CVE-2026-108822 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-108822

Vulnerability Analysis

The vulnerability exists in the sipt module, which allows Kamailio to extract and manipulate ISUP (ISDN User Part) parameters carried within SIP messages. The isup_get_calling_party function in src/modules/sipt/ss7_parser.c writes parsed calling party data into a fixed-size static buffer without validating that the parsed length fits within the buffer boundary. A remote attacker who can deliver crafted SIP messages containing malformed ISUP payloads can trigger the overflow.

The pre-patch code allocates a static 26-byte buffer (static char sb_s_buf[26]) to hold the formatted calling party string. When the embedded length field in the ISUP message exceeds the available buffer space, the parser writes past the buffer boundary. The patch introduces a MAX_SB_BUF_LEN constant and robust length validations across the ISUP parser functions.

Root Cause

The root cause is missing length validation when copying ISUP parameter data into a statically sized stack or BSS buffer. The parser trusts the length value supplied in the untrusted ISUP payload and uses it as the copy length without bounding it to the destination buffer size. This is a classic [CWE-119] improper restriction of operations within memory buffer bounds.

Attack Vector

Exploitation is network-reachable. An attacker sends a SIP message (such as an INVITE) that embeds a crafted ISUP body with an oversized calling-party length field. When the sipt module processes the message and invokes isup_get_calling_party, the oversized length triggers out-of-bounds writes. No authentication or user interaction is required, matching the attack profile for an exposed SIP-SS7 gateway.

// Patch excerpt - src/modules/sipt/sipt.c
// Source: https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21
 static int sipt_get_calling_party(
 		struct sip_msg *msg, pv_param_t *param, pv_value_t *res)
 {
-	static char sb_s_buf[26];
+	static char sb_s_buf[MAX_SB_BUF_LEN];
 	str body;
-	memset(sb_s_buf, 0, 26);
+	memset(sb_s_buf, 0, MAX_SB_BUF_LEN);
 
 	if(sipt_check_IAM(msg, &body) != 1) {
 		LM_INFO("could not check IAM\n");

// Patch excerpt - src/modules/sipt/ss7.h defining the bound
// Source: https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21
 #define SS7_SCREENING_NETWORK_PROVIDED_FAILED 0x02
 #define SS7_SCREENING_NETWORK_PROVIDED 0x03

+/* Maximum buffer length */
+#define MAX_SB_BUF_LEN 26

 #ifndef bool
 #define bool unsigned char

Detection Methods for CVE-2026-108822

Indicators of Compromise

Unexpected Kamailio process crashes or restarts with segmentation faults originating from the sipt module
SIP messages containing ISUP MIME parts (application/ISUP) with abnormally large length fields in calling-party parameters
Inbound SIP INVITE traffic from untrusted peers targeting SIP-SS7 gateway nodes
Core dumps referencing isup_get_calling_party or sipt_get_calling_party symbols

Detection Strategies

Enable Kamailio core dump collection and correlate crash signatures against the sipt module stack frames
Deploy SIP-aware intrusion detection signatures that flag ISUP payloads with length fields exceeding 26 bytes
Monitor the Kamailio syslog output for parser warnings and abnormal LM_ERR events emitted by the sipt module

Monitoring Recommendations

Track Kamailio service uptime and restart frequency on all SIP-SS7 interworking nodes
Log and review all SIP peers permitted to send ISUP-encapsulated bodies, limiting them to trusted carriers
Capture packet traces at gateway ingress and alert on malformed multipart/mixed SIP bodies with ISUP parts

How to Mitigate CVE-2026-108822

Immediate Actions Required

Upgrade Kamailio to version 6.0.8 or 6.1.4, which contain commit 3667bebf8d0bea07ed16218fd921d07db87aeb21
Inventory all Kamailio deployments and identify any instance loading the sipt module via loadmodule "sipt.so"
Restrict SIP ingress to authenticated or whitelisted peers until patching is complete

Patch Information

The fix is included in Kamailio releases 6.0.8 and 6.1.4. The upstream commit 3667bebf8d0bea07ed16218fd921d07db87aeb21 adds the MAX_SB_BUF_LEN constant and introduces robust length validations across the ISUP message parser. See the Kamailio Commit 3667beb, Pull Request #4905, and the Kamailio Release 6.0.8 notes.

Workarounds

Disable the sipt module if SIP-SS7 interworking is not required for the deployment
Apply SIP ACLs or Session Border Controller (SBC) rules to drop inbound messages containing ISUP MIME parts from untrusted sources
Place Kamailio behind an SBC that normalizes or strips ISUP bodies before forwarding

bash

# Example Kamailio configuration: disable the sipt module if unused
# Comment out or remove the following line in kamailio.cfg
# loadmodule "sipt.so"

# Verify installed Kamailio version after upgrade
kamailio -v | grep -i version

# Confirm the patched source contains the MAX_SB_BUF_LEN definition
grep -R "MAX_SB_BUF_LEN" src/modules/sipt/