A vulnerability was detected in Kamailio 5.5. The affected element is the function sr_push_yy_state of the file src/core/cfg.lex of the component Configuration File Handler. The manipulation results in use after free. The attack must be initiated from a local position. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-12205
• https://shimo.im/docs/ZzkLMVMLOzIRlpAQ
• https://vuldb.com/?ctiid.329875
• https://vuldb.com/?id.329875
• https://vuldb.com/?submit.673225
• https://www.openwall.com/lists/oss-security/2025/10/27/8
• https://www.openwall.com/lists/oss-security/2025/11/02/3
• http://www.openwall.com/lists/oss-security/2025/10/27/12
• http://www.openwall.com/lists/oss-security/2025/10/27/8