UBUNTU-CVE-2026-106803: Buffer Overflow
A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the imsregistrarpcscf module. When processing a crafted application/reginfo+xml NOTIFY message, processcontact() copies an attacker-controlled port value from the alias parameter into a fixed 5-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger stack corruption and terminate the P-CSCF process, resulting in denial of service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Ubuntu systems running Kamailio v6.1.3 or v6.1.4 with the ims_registrar_pcscf module exposed to process application/reginfo+xml NOTIFY messages are affected.
Does exploitation require authentication or prior access?
No. An unauthenticated remote attacker can send a crafted application/reginfo+xml NOTIFY message containing an oversized alias port value.
What is the practical impact of successful exploitation?
The crafted port value can corrupt stack memory and terminate the P-CSCF process, causing denial of service.