CVE-2025-12206: Kamailio rvalue.c rve_is_constant null pointer dereference
A flaw has been found in Kamailio 5.5. The impacted element is the function rveisconstant of the file src/core/rvalue.c. This manipulation causes null pointer dereference. The attack needs to be launched locally. The exploit has been published and may be used. It is still unclear if this vulnerability genuinely exists. This attack requires manipulating config files which might not be a realistic scenario in many cases. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12206?
CVE-2025-12206 is considered to be of medium severity due to its potential for local exploitation leading to system instability.
How do I fix CVE-2025-12206?
To mitigate CVE-2025-12206, update Kamailio to the latest version provided by the vendor that includes the necessary patches.
What systems are affected by CVE-2025-12206?
CVE-2025-12206 affects Kamailio versions prior to the patched release that addresses the null pointer dereference flaw.
Is CVE-2025-12206 exploitable remotely?
CVE-2025-12206 requires local access to exploit, meaning an attacker must have local system access to trigger the vulnerability.
What are the potential impacts of CVE-2025-12206?
The potential impacts of CVE-2025-12206 include application crashes and denial of service due to null pointer dereference.