Heap Buffer Overflow Vulnerability in Asterisk Telephony Toolkit
CVE-2026-57198
2.3LOW
What is CVE-2026-57198?
Asterisk, an open-source telephony toolkit, is vulnerable to a heap buffer overflow in configurations where the chan_sip channel driver is enabled and the textsupport option is set to 'yes'. This vulnerability allows authenticated attackers to exploit carefully crafted packets, potentially leading to remote code execution or causing system instability. The chan_sip driver was deprecated in Asterisk 20 and removed in later versions, but deployments still using affected versions may be at risk. Users are advised to upgrade to the latest patched versions to ensure their systems' security.
Affected Version(s)
asterisk < 20.20.1 < 20.20.1
asterisk >= 21.0.0-pre1, < 21.12.3 < 21.0.0-pre1, 21.12.3
asterisk >= 22.0.0-pre1, < 22.10.1 < 22.0.0-pre1, 22.10.1