Critical severity9.8NVD Advisory· Published Apr 11, 2016· Updated Jun 17, 2026

CVE-2016-2385

Description

Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER and SER) before 4.3.5 allows remote attackers to cause a denial of service (memory corruption and process crash) or possibly execute arbitrary code via a large SIP packet.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Kamailio/Kamailio2 versions
cpe:2.3:a:kamailio:kamailio:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:kamailio:kamailio:*:*:*:*:*:*:*:*range: <=4.3.4
- (no CPE)range: <4.3.5
Debian/linux
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/136477/Kamailio-4.3.4-Heap-Overflow.htmlnvdExploit
census-labs.com/news/2016/03/30/kamailio-seas-heap-overflow/nvdExploit
github.com/kamailio/kamailio/commit/f50c9c853e7809810099c970780c30b0765b0643nvdExploit
www.exploit-db.com/exploits/39638/nvdExploit
www.debian.org/security/2016/dsa-3535nvd
www.debian.org/security/2016/dsa-3537nvd
www.kamailio.org/pub/kamailio/4.3.5/ChangeLognvd
www.securityfocus.com/archive/1/537926/100/0/threadednvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.024
exploit	0.030
kev	0.000
patch	-0.070
ransomware	0.000