Out-of-Bounds Read in Asterisk Telephony Toolkit

CVE-2026-57184

What is CVE-2026-57184?

Asterisk, an open-source telephony toolkit, suffers from an out-of-bounds read vulnerability before specific versions. This flaw resides in the chan_ooh323 Q.931 information-element parser, which fails to perform comprehensive bounds checking. An attacker, without authentication, can exploit this through specially crafted setup packets, potentially leading to the crashing of Asterisk services. This vulnerability specifically impacts installations where the chan_ooh323 driver is compiled and installed, making it critical for users to ensure their systems are up-to-date with the latest patches.

References