A stack‑based buffer overflow was discovered in the Kamailio IMS registrar pscf module. The flaw allows an unauthenticated remote attacker to craft a NOTIFY message that copies an attacker‑controlled port value into a fixed five‑byte stack buffer without length validation, corrupting the stack and causing the P‑CSCF process to terminate, which results in denial of service.

Kamailio versions 6.1.3 and 6.1.4 are vulnerable when the ims_registrar_pcscf module is enabled. The vulnerability is triggered by processing a crafted application/reginfo+xml NOTIFY message and occurs when the alias parameter contains a port value longer than five bytes.

The flaw can be exploited over the network without authentication. No CVSS score is published and EPSS information is unavailable, so the precise exploitation likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog.