CVE-2025-12205 Kamailio Configuration File cfg.lex sr_push_yy_state use after free
A local attacker with config file access can trigger a use-after-free in Kamailio, potentially causing crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12205?
CVE-2025-12205 is a medium-severity use after free vulnerability in Kamailio, published on 27 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was detected in Kamailio 5.5. The affected element is the function sr_push_yy_state of the file src/core/cfg.lex of the component Configuration File Handler. The manipulation results in use after free. The attack must be initiated from a local position. The exploit is now public and may be used. The real existence of this vulnerability is still doubted at the moment. This attack requires manipulating config files which might not be a realistic scenario in many cases. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2025-12205?
It affects 1 product.
Products include Kamailio Kamailio.
How do I fix CVE-2025-12205?
No fix has been published for CVE-2025-12205 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-12205 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-12205 exists.
Other vulnerabilities in Kamailio
Sources
Also known as DEBIAN-CVE-2025-12205, GHSA-j768-6r6g-m9h3, UBUNTU-CVE-2025-12205.