Stack Buffer Overflow in Asterisk's XMPP Namespace Processing
CVE-2026-57188
7.1HIGH
What is CVE-2026-57188?
An authenticated attacker could exploit a stack buffer overflow vulnerability specifically in Asterisk's XMPP handling through crafted packets. This requires the res_xmpp module to be loaded, an XMPP connection configured in xmpp.conf, and the attacker to possess an account on either the same server or a federated one. This issue has been addressed in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, along with Certified Asterisk versions 20.7-cert11 and 22.8-cert3.
Affected Version(s)
asterisk < 20.20.1 < 20.20.1
asterisk >= 21.0.0-pre1, < 21.12.3 < 21.0.0-pre1, 21.12.3
asterisk >= 22.0.0-pre1, < 22.10.1 < 22.0.0-pre1, 22.10.1