PT-2025-43866 · Kamailio+1 · Kamailio+1

Vuldb + 1 · Published 2025-10-27 · Updated 2025-10-28 · CVE-2025-12206

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Kamailio version 5.5

Description A flaw exists in Kamailio where manipulation of the rve is constant function within the src/core/rvalue.c file can lead to a null pointer dereference. The attack requires local access. The exploit for this issue has been published. The vendor was contacted regarding this disclosure but did not respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

CVE-2025-12206

Affected Products

Debian

Kamailio

References · 18

• 🔥 https://shimo.im/docs/aBAYMVMB2jUP9jAj · Exploit
• https://osv.dev/vulnerability/CVE-2025-12206 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-12206 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-12206 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-12206 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-12206 · Security Note
• https://ubuntu.com/security/CVE-2025-12206 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12206 · Security Note
• https://t.me/cveNotify/140377 · Telegram Post
• https://vuldb.com/?submit.673240 · Note
• https://openwall.com/lists/oss-security/2025/10/27/8 · Note
• https://vuldb.com/?id.329876 · Note
• https://t.me/CVEtracker/35777 · Telegram Post
• http://openwall.com/lists/oss-security/2025/10/27/8 · Note
• https://vuldb.com/?ctiid.329876 · Note