Stack Buffer Overflow in Asterisk Telephony Toolkit Affects Multiple Versions
CVE-2026-57201
What is CVE-2026-57201?
Asterisk, an open-source private branch exchange and telephony toolkit, has a stack buffer overflow vulnerability in its H.323 ooTrace() function. This issue arises from the unbounded use of vsprintf, allowing a remote attacker to craft a malicious packet that can crash the Asterisk process. Notably, this vulnerability affects systems where the chan_ooh323 add-on channel driver is explicitly compiled and installed, requiring it to be publicly accessible. Mitigation has been implemented in Asterisk versions 20.20.1, 21.12.3, 22.10.1, and 23.4.1, along with Certified Asterisk versions 20.7-cert11 and 22.8-cert3.
Affected Version(s)
asterisk < 20.20.1 < 20.20.1
asterisk >= 21.0.0-pre1, < 21.12.3 < 21.0.0-pre1, 21.12.3
asterisk >= 22.0.0-pre1, < 22.10.1 < 22.0.0-pre1, 22.10.1