CVE-2026-39863

CVE-2026-39863 is an out-of-bounds memory access vulnerability affecting Kamailio, an open-source SIP signaling server, prior to versions 5.8.8, 6.0.6, and 6.1.1. The vulnerability specifically impacts instances configured with TCP or TLS listeners and can be triggered remotely through a specially crafted data packet, resulting in denial of service via process crash. The vulnerability carries a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring no authentication, privileges, or user interaction. While the attack complexity is low and exploitation is straightforward, the impact is limited to availability, with no potential for data confidentiality or integrity compromise. There is currently no evidence of active exploitation in the wild. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog, and it remains inactive on exploit tracking lists. The EPSS score of 0.0004 indicates a very low probability of exploitation in real-world attacks, suggesting this remains a low-priority threat despite its high CVSS rating. Organizations running affected Kamailio versions should prioritize patching to mitigate denial of service risks.