A heap-based buffer overflow in the shm_malloc function of the CDP Diameter Receiver component of Kamailio can be triggered by crafted network data, allowing a remote attacker to overflow a heap buffer and potentially execute arbitrary code. The flaw is classified as CWE-119 and CWE-122 and is acknowledged to be exploitable from remote sources without local privileges. According to the description, the publicly available exploit makes this vulnerability actionable for adversaries.

The affected products are Kamailio versions up to 5.8.8, 6.0.7, 6.1.4, and the development build 6.2.0‑dev1. Any deployments running these releases are vulnerable; upgrading to version 6.0.8 or later resolves the issue.

The CVSS score of 6.9 indicates a moderate severity. Although the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog. The attack can be performed remotely by sending malicious CDP Diameter messages; therefore the risk is heightened for systems exposed to the internet or untrusted networks. Due to the available public exploit, attackers could immediately target vulnerable Kamailio installations if no mitigation is applied.