CVE-2016-2385: Debian Linux

Critical severity, CVSS 9.8. EPSS: 30.5% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER and SER) before 4.3.5 allows remote attackers to cause a denial of service (memory corruption and process crash) or possibly execute arbitrary code via a large SIP packet.

Affected products

• Debian Debian Linux: version 8.0 only
• Kamailio Kamailio: up to and including 4.3.4

Published 2016-04-11. Last modified 2026-06-17.