A vulnerability was detected in Kamailio 5.5. The affected element is the function sr_push_yy_state of the file src/core/cfg.lex of the component Configuration File Handler. The manipulation results in use after free. The attack must be initiated from a local position. The exploit is now public and may be used. The real existence of this vulnerability is still doubted at the moment. This attack requires manipulating config files which might not be a realistic scenario in many cases. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Local

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Kamailio
  • Kamailio

Configuration 1 [-]

cpe:2.3:a:kamailio:kamailio:5.5.0:*:*:*:*:*:*:*

No data.

References
Link Providers
http://www.openwall.com/lists/oss-security/2025/10/27/12 cve-icon
http://www.openwall.com/lists/oss-security/2025/10/27/8 cve-icon
https://shimo.im/docs/ZzkLMVMLOzIRlpAQ/ cve-icon cve-icon
https://vuldb.com/?ctiid.329875 cve-icon cve-icon
https://vuldb.com/?id.329875 cve-icon cve-icon
https://vuldb.com/?submit.673225 cve-icon cve-icon
https://www.openwall.com/lists/oss-security/2025/10/27/8 cve-icon
https://www.openwall.com/lists/oss-security/2025/11/02/3 cve-icon cve-icon
History

Tue, 04 Nov 2025 22:30:00 +0000

Type Values Removed Values Added
References

Mon, 03 Nov 2025 23:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Kamailio 5.5. The affected element is the function sr_push_yy_state of the file src/core/cfg.lex of the component Configuration File Handler. The manipulation results in use after free. The attack must be initiated from a local position. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. A vulnerability was detected in Kamailio 5.5. The affected element is the function sr_push_yy_state of the file src/core/cfg.lex of the component Configuration File Handler. The manipulation results in use after free. The attack must be initiated from a local position. The exploit is now public and may be used. The real existence of this vulnerability is still doubted at the moment. This attack requires manipulating config files which might not be a realistic scenario in many cases. The vendor was contacted early about this disclosure but did not respond in any way.
References

Tue, 28 Oct 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 28 Oct 2025 15:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:kamailio:kamailio:5.5.0:*:*:*:*:*:*:*

Tue, 28 Oct 2025 01:30:00 +0000

Type Values Removed Values Added
References

Mon, 27 Oct 2025 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Kamailio
Kamailio kamailio
Vendors & Products Kamailio
Kamailio kamailio

Mon, 27 Oct 2025 03:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Kamailio 5.5. The affected element is the function sr_push_yy_state of the file src/core/cfg.lex of the component Configuration File Handler. The manipulation results in use after free. The attack must be initiated from a local position. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Kamailio Configuration File cfg.lex sr_push_yy_state use after free
Weaknesses CWE-119
CWE-416
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2025-10-27T02:32:07.777Z

Updated: 2025-11-04T21:09:26.652Z

Reserved: 2025-10-25T11:52:14.661Z

Link: CVE-2025-12205

cve-icon Vulnrichment

Updated: 2025-11-04T21:09:26.652Z

cve-icon NVD

Status : Modified

Published: 2025-10-27T03:15:49.560

Modified: 2025-11-04T22:16:05.893

Link: CVE-2025-12205

cve-icon Redhat

No data.