Out-of-Bounds Write Vulnerability in Asterisk Telephony Toolkit
CVE-2026-57194
What is CVE-2026-57194?
The vulnerability in the Asterisk telephony toolkit arises from improper handling of incoming request packets in the chan_unistim module. An attacker may exploit this flaw by sending a specifically crafted packet, leading to an out-of-bounds write error that affects the phone_number field, ultimately crashing the application. The issue requires the chan_unistim module to be active along with a properly configured UNISTIM UDP port that is accessible to the attacker. Affected users should update to fixed versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, or the certified Asterisk releases 20.7-cert11, 22.8-cert3.
Affected Version(s)
asterisk < 20.20.1 < 20.20.1
asterisk >= 21.0.0-pre1, < 21.12.3 < 21.0.0-pre1, 21.12.3
asterisk >= 22.0.0-pre1, < 22.10.1 < 22.0.0-pre1, 22.10.1