Out-of-Bounds Write Vulnerability in Asterisk Telephony Toolkit
CVE-2026-57189
What is CVE-2026-57189?
Asterisk, an open source private branch exchange and telephony toolkit, is susceptible to an out-of-bounds write vulnerability. An authenticated attacker can exploit this issue during the generation accumulation process by sending specially crafted packets. This exploitation can lead to remote code execution or crashes in affected systems. It is crucial to note that the chan_sip channel driver needs to be installed and configured, and its textsupport option must be enabled for the vulnerability to be exploitable. Though the chan_sip driver was deprecated in Asterisk 20, it remains relevant for earlier versions. Recent patches introduced in Asterisk versions 20.20.1, 21.12.3, 22.10.1, and 23.4.1 address this issue, however, the scope of affected release tracks could still include certain configurations.
Affected Version(s)
asterisk < 20.20.1 < 20.20.1
asterisk >= 21.0.0-pre1, < 21.12.3 < 21.0.0-pre1, 21.12.3
asterisk >= 22.0.0-pre1, < 22.10.1 < 22.0.0-pre1, 22.10.1