Memory Corruption in Asterisk Telephony Toolkit Affecting Multiple Versions
CVE-2026-57199
2.3LOW
What is CVE-2026-57199?
Asterisk, an open-source telephony toolkit, is susceptible to a memory corruption vulnerability due to insufficient bounds checking in the app_sms.c file. This issue arises when external SMS lengths are improperly managed, allowing attackers to corrupt memory or potentially crash the system. Administrators using the SMS dialplan application must validate input data to mitigate this risk. The vulnerability has been addressed in several updates, including Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certified releases 20.7-cert11 and 22.8-cert3.
Affected Version(s)
asterisk < 20.20.1 < 20.20.1
asterisk >= 21.0.0-pre1, < 21.12.3 < 21.0.0-pre1, 21.12.3
asterisk >= 22.0.0-pre1, < 22.10.1 < 22.0.0-pre1, 22.10.1