CVE-2026-93962

Executive Summary

CVE-2026-93962 is a remotely exploitable heap-based buffer overflow in the CDP Diameter Receiver component of Kamailio, an open-source SIP/telephony (VoIP) server used as a proxy, registrar, and IMS/Diameter gateway. The flaw resides in the interaction of the shm_malloc shared-memory allocator within src/modules/cdp/receiver.c and is triggered by a manipulation that can be issued remotely against an exposed Diameter (or Diameter-over-SCTP/TCP) listener. Public exploit availability combined with a CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:N/UI:N/S:C) marks this as a high-priority, pre-auth remote code execution / denial-of-service risk for any organization running affected Kamailio versions with the cdp module loaded. Immediate action is to upgrade to Kamailio 6.0.8 or isolate the Diameter listener.

Technical Analysis

The vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and manifests as a heap-based buffer overflow. The affected code is src/modules/cdp/receiver.c of the cdp (CDP/C Diameter) module — Kamailio's Diameter protocol stack used for AAA, IMS, and telecom signaling. The reported impacted element is the shm_malloc function, Kamailio's shared-memory allocator used to allocate packet/message structures managed by the CDP receiver.

Mechanism at the vulnerability-class level: A heap-based buffer overflow in a message-receiving path typically arises when length, attribute-count, or AVP (Attribute-Value-Pair) size fields parsed from an inbound Diameter frame are trusted to size or copy into a shared-memory buffer without adequate bounds validation. When attacker-controlled length metadata exceeds what shm_malloc actually allocated, a write past the end of the heap chunk corrupts adjacent allocations in Kamailio's shared memory segment. Kamailio's shared memory design means that corruption of one chunk can affect unrelated modules and worker processes, materially widening the blast radius beyond the CDP handler. Successful corruption can crash the daemon or, with sufficient heap grooming, redirect control flow.

Critically, the NVD description does not disclose the specific packet field, AVP type, or Diameter command code involved. No further code-level detail (e.g., which AVP or the exact length check that is missing) can be stated without fabrication; only the function/file/module named above is confirmed.

Attack surface: The CDP receiver operates on the Diameter transport (traditionally TCP/SCTP port 3868). Any Kamailio deployment that loads the cdp module and exposes its Diameter listener to an untrusted network (interconnect, carrier peering, or internet-facing installations) is in scope. The CVSS "Scope: Changed (S:C)" reflects that a compromise of the vulnerable component impacts resources beyond its security authority — consistent with corruption spilling into shared-memory state used by other processes.

Exploitation Scenarios

No public PoC link is provided in this dataset beyond the statement that "the exploit has been made available to the public." The attack chain below is described strictly at the vulnerability-class level using only confirmed artifacts (shm_malloc, src/modules/cdp/receiver.c, CDP Diameter receiver, remote delivery).

1. Reconnaissance / target identification. An attacker scans for exposed Kamailio Diameter endpoints — commonly the Diameter port (TCP/SCTP 3868) and identifiable via banner/banner-less protocol probing or Shodan-class discovery using product:"Kamailio" and port:3868. Targets of interest are VoIP/IMS gateways, interconnect nodes, and telecom operators that expose Diameter to peer or untrusted networks.

2. Trigger of the memory-safety flaw. The attacker establishes a Diameter session/connection to the CDP receiver and sends a crafted Diameter message whose length/AVP metadata causes the receiving path to request or index a shared-memory buffer in an unsafe way relative to the actual data length. The overflow occurs in the shm_malloc allocation path in src/modules/cdp/receiver.c — i.e., the manipulated message drives an out-of-bounds heap write. The exact triggering field is not publicly specified and is not reproduced here to avoid fabrication.

3. Payload / execution. Because the primitive is a heap buffer overflow, exploitation requires heap grooming to place the overwrite adjacent to a targeted structure in shared memory. At the vulnerability-class level, payload delivery is accomplished by transmitting the malformed Diameter frame over the network; no file drop, authentication, or user interaction is required (PR:N, UI:N). A trivial variant of the same primitive yields a reliable denial-of-service (crash of the Diameter worker / daemon) even without achieving control-flow hijack.

4. Post-exploitation impact. Depending on exploitation reliability: (a) denial-of-service — Kamailio crashes, dropping all SIP/Diameter signaling (telephony outage), or (b) memory corruption leading to out-of-bounds read/write (C:L/I:L) that may enable further control-flow manipulation. The Changed Scope reflects potential lateral effects on other modules sharing the corrupted memory segment.

Because no vendor-verified PoC or exploit code is included in this dataset, the weaponization steps above are inferred from the vulnerability class, and are explicitly flagged as such.

Impact Assessment

• Confidentiality / Integrity / Availability (CVSS: L/L/L): Each impact is Low in isolation, but the composite effect on a telecom signaling node is severe — a crash of Kamailio halts call routing and Diameter AAA for all connected peers.
• Scope: Changed: Memory corruption in Kamailio's shared-memory segment can affect resources outside the CDP component's authority, meaning other Kamailio modules/processes may be impacted.
• Attack Vector / Complexity: AV:N, AC:L, PR:N, UI:N — remotely reachable with low complexity and no privileges or user interaction.
• Blast radius: Any deployment with the cdp module loaded and its Diameter listener reachable. In carrier/IMS environments this can cascade to dependent network functions; in internet-exposed single-node VoIP deployments it is a single-point DoS.
• Exploit maturity: Public exploit availability elevates urgency. EPSS has not yet scored this CVE; do not assume low likelihood. CISA KEV status: not listed.
• Business impact: Service outage of voice/Diameter services, potential telephony abuse (toll fraud, signaling manipulation) if code execution is achieved, and regulatory/compliance exposure for telecom operators.

Detection Guidance

Sigma Rule

title: Kamailio CDP Diameter Receiver Heap Overflow Attempt (CVE-2026-93962)
id: 6f1a2b3c-4d5e-6f70-8192-a3b4c5d6e7f8
status: experimental
description: Detects anomalous Kamailio CDP / Diameter receiver activity consistent with exploitation of CVE-2026-93962 (heap buffer overflow in src/modules/cdp/receiver.c).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93962
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  product: linux
  service: kamailio
detection:
  selection_proc:
    Image|endswith: '/kamailio'
  selection_crash:
    Message|contains:
      - 'CRITICAL'
      - 'BUG'
      - 'buffer overflow'
      - 'shm_malloc'
      - 'cdp'
  selection_signal:
    Message|contains|all:
      - 'kamailio'
      - 'segfault'
  condition: selection_proc and (selection_crash or selection_signal)
falsepositives:
  - Benign module load/free during restart
level: high
tags:
  - attack.t1190
  - cve.2026.93962

YARA Rule

rule CVE_2026_93962_Kamailio_CDP_Heap_Overflow
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects references to the vulnerable Kamailio CDP receiver path associated with CVE-2026-93962"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93962"
        date = "2026-01-01"
        cve = "CVE-2026-93962"

    strings:
        $mod  = "cdp" ascii wide
        $file = "src/modules/cdp/receiver.c" ascii
        $alloc = "shm_malloc" ascii
        $diam = "Diameter" ascii wide

    condition:
        uint32(0) == 0x464C457F and   // ELF binary
        $alloc and $mod and
        ($file or $diam)
}

Suricata IDS Rule

alert tcp any any -> any 3868 (msg:"CVE-2026-93962 Kamailio CDP Diameter possible heap overflow attempt (oversized AVP/length)"; flow:to_server,established; content:"|01 00|"; offset:0; depth:2; byte_test:2,>,8192,1,relative; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-93962; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-93962; sid:202693962; rev:1;)

alert sctp any any -> any 3868 (msg:"CVE-2026-93962 Kamailio CDP Diameter heap overflow attempt over SCTP"; flow:to_server; classtype:attempted-admin; reference:cve,2026-93962; sid:202693963; rev:1;)

Elastic Detection

process where event.type in ("start", "end") and process.name == "kamailio" and
  process.command_line != null and
  (
    process.command_line : "*cdp*" or
    process.command_line : "*receiver*"
  ) and sequence by host.id
  [process where process.name == "kamailio" and event.action == "signal"]
  [file where file.path : "*cdp*" or file.name : "core*"]

Splunk SPL Query

index=linux OR index=syslog sourcetype=syslog
  (process_name=kamailio OR "kamailio")
  ("shm_malloc" OR "buffer overflow" OR "cdp" OR "receiver.c" OR "segfault" OR "core dumped" OR "CRITICAL")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(host) as hosts values(message) as messages
        by process_name, Message
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="kamailio,cdp,cve-2026-93962,">
  <rule id="202693" level="12">
    <decoded_as>syslog</decoded_as>
    <program_name>kamailio</program_name>
    <match>shm_malloc|buffer overflow|cdp|receiver\.c</match>
    <description>CVE-2026-93962: Kamailio CDP receiver heap overflow / crash detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_93962,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source in this dataset). The NVD description names fixing commits and a target version, but no tracked vendor advisory, OSV package, or vendor-fix source is present here, so treat this as unverified until confirmed against the upstream repository.

1. Immediate mitigations

   • Restrict network access to the Kamailio Diameter listener (do not expose CDP/Diameter to untrusted networks); apply firewall/ACL and SCTP/TCP allow-listing.
   • If the cdp module is not required, unload/disable it to remove the attack surface entirely.
   • Segment VoIP/Diameter nodes from general corporate networks to reduce blast radius.

2. Patch / upgrade steps

   • Upgrade to Kamailio 6.0.8 as stated in the NVD description.
   • Verify the fixing commits (38711a3e788de0130d48cb485578c482b57d9351 / 4f62235b6f477b649c5cc18b0c81b4e26c949b98) are present in the deployed branch.
   • Confirm no production backport drifts from the patched versions.

3. Long-term hardening

   • Deploy memory-safety protections (ASLR, hardened allocators where applicable) and process supervision/auto-restart with alerting.
   • Monitor upstream Kamailio advisories and telecom CERT feeds for this CVE ID.
   • Add the Sigma/YARA/Suricata detections above to SOC pipelines.

References

1. NVD — CVE-2026-93962: https://nvd.nist.gov/vuln/detail/CVE-2026-93962
2. Kamailio project repository (fixing commits): commit 38711a3e788de0130d48cb485578c482b57d9351 and 4f62235b6f477b649c5cc18b0c81b4e26c949b98
3. Kamailio 6.0.8 release / upstream changelog (verify at kamailio.org)
4. CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer: https://cwe.mitre.org/data/definitions/119.html
5. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Note: No CISA KEV listing and no named threat-actor campaign are associated with this CVE in the provided data. Public exploit code is reported available by the NVD description, but no PoC URL or exploit sample is included in this dataset; no OSV package data or vendor advisory URL was supplied, so those fields are intentionally omitted rather than fabricated.