A buffer overflow exists in the isup_get_calling_party function of Kamailio’s sipt module, caused by improper handling of argument length in ss7_parser.c. The flaw permits an attacker that sends crafted ISUP messages to overflow a stack buffer and potentially execute arbitrary code on the Kamailio process. The CVE description indicates that the vulnerability can be triggered remotely, implying a network‑based attack surface.

Systems running Kamailio up to version 6.0.7 or 6.1.3 are susceptible, as the affected component is the sipt module found in those releases. The patch is available in Kamailio 6.0.8 and 6.1.4. Upgrading the Kamailio installation to at least these versions resolves the buffer overflow.

The CVSS base score of 6.9 reflects a moderate risk combined with medium confidentiality, integrity, and availability impact. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited current exploitation data. However, the remote attack vector and lack of mitigation in older releases mean a determined attacker could exploit the flaw before an update, warranting prompt remediation.