critical · CVSS v3 9.8

CVE-2026-106803

A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module. When processing a …

Description

A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module. When processing a crafted application/reginfo+xml NOTIFY message, process_contact() copies an attacker-controlled port value from the alias parameter into a fixed 5-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger stack corruption and terminate the P-CSCF process, resulting in denial of service.

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.8
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-120228

A critical OS command injection flaw exists in the ioos service of WAVLINK WN553X1-B routers. Remote attackers can manipulate group_id/group_name arguments to execute arbitrary commands. The vulnerability can compromise device control and network security.

View analysis

critical

CVE-2026-120279

A critical OS command injection flaw exists in the openvpn_cli handler of WAVLINK WN536AX6-A routers, allowing remote attackers to execute arbitrary commands via the file_id parameter. The vulnerability can be exploited over the network without authentication. It has been publicly disclosed and is actively used by threat actors.

View analysis

critical

CVE-2026-29508

ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote code execution on unprotected builds or denial of service on hardened builds with stack protections.

View analysis

critical

CVE-2026-49906

An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting navigation app focus. The privileged `ClusterHomeSample` application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content.

View analysis