Stack Buffer Overflow Vulnerability in Asterisk Telephony Toolkit
CVE-2026-57191
8.2HIGH
What is CVE-2026-57191?
A vulnerability in the Asterisk Telephony Toolkit, specifically within the res_pjsip_pubsub component, allows unauthenticated attackers to exploit an unbounded sscanf during the parsing of the MWI NOTIFY Message-Account field. This exploitation can lead to a stack buffer overflow, disrupting the telephony service and permanently disabling all SIP functionality. Affected users will need to restart Asterisk to restore normal operations. The issue has been addressed in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and the Certified Asterisk 20.7-cert11, 22.8-cert3.
Affected Version(s)
asterisk < 20.20.1 < 20.20.1
asterisk >= 21.0.0-pre1, < 21.12.3 < 21.0.0-pre1, 21.12.3
asterisk >= 22.0.0-pre1, < 22.10.1 < 22.0.0-pre1, 22.10.1