Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-57188— Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling

Quick assessment

Affected

asterisk asterisk

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Asterisk 是一款开源的专用分支交换机（PBX）和电话工具包。在 Asterisk 20.20.1、21.12.3、22.10.1、23.4.1 以及认证版 Asterisk 20.7-cert11、22.8-cert3 之前的版本中，经过身份验证的攻击者可通过精心构造的数据包，在模块处理 XMPP 命名空间前缀时引发栈缓冲区溢出。触发此漏洞需满足以下条件：模块必须已加载，中已配置 XMPP 连接，且攻击者必须在同一服务器或联邦服务器上拥有 XMPP 账户。该问题已在 Asterisk 20.20.1、

CVSS 7.1 · High Updated Oct 28, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 6

Vendor	Product	Version Range	Status
asterisk	asterisk	`< 20.20.1`	affected
		`>= 21.0.0-pre1, < 21.12.3`	affected
		`>= 22.0.0-pre1, < 22.10.1`	affected
		`>= 23.0.0-pre1, < 23.4.1`	affected
asterisk	certified-asterisk	`< 20.7-cert11`	affected
		`>= 22.8-cert1-pre1, < 22.8-cert3`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling

Source: CVE Program / CVE List V5

Vulnerability Description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in `res_xmpp` `XMPP namespace prefix` handling using carefully crafted packets. The `res_xmpp` module must be loaded, an XMPP connection must be configured in `xmpp.conf`, and the attacker must have an XMPP account on the same or a federated server. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存写

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
asterisk	asterisk	< 20.20.1	-
asterisk	certified-asterisk	< 20.7-cert11	-

II. Public POCs for CVE-2026-57188

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-57188

请登录查看更多情报信息。

Vendor Pages for CVE-2026-57188 (7)

🔗 GitHub - asterisk/asterisk at 24.0.0-pre1 · GitHub x_refsource_MISC
🔗 Release Asterisk Release 23.4.1 · asterisk/asterisk · GitHub x_refsource_MISC
🔗 Release Asterisk Release 21.12.3 · asterisk/asterisk · GitHub x_refsource_MISC
🔗 Release Asterisk Release 20.20.1 · asterisk/asterisk · GitHub Read full article x_refsource_MISC
🔗 Release Asterisk Release 22.10.1 · asterisk/asterisk · GitHub x_refsource_MISC
🔗 Release Asterisk Release certified-22.8-cert3 · asterisk/asterisk · GitHub x_refsource_MISC
🔗 Release Asterisk Release certified-20.7-cert11 · asterisk/asterisk · GitHub x_refsource_MISC

Other References for CVE-2026-57188 (8)

https://github.com/asterisk/asterisk/security/advisories/GHSA-mxgm-8c6f-5p8f x_refsource_CONFIRM
https://github.com/asterisk/asterisk/commit/12072a559f592736a44dd9fbe1594e84714edfb4 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/3c4b08cf94eeaa3faefb3ae6c2d6ce1bd9747a13 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/d570a85e45153a36919ace5d0ab06a195b30f9d1 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/e329a6803ac5214028f98cc5f0b7167d66e32c08 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/5e626250628b2579530f3f17e7b0aa37d082873b x_refsource_MISC
https://github.com/asterisk/asterisk/commit/433102c16b8edfc31d28c96166fef03fe72fb923 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/1328dbb503da4aa11a480a9c28e170f17e5f4e84 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-57188

Same Patch Batch · asterisk · 2026-10-27 · 11 CVEs total

CVE-2026-57202	8.1 HIGH	Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
CVE-2026-57197	7.7 HIGH	Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
CVE-2026-57201	7.5 HIGH	Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-
CVE-2026-57195	7.5 HIGH	Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication
CVE-2026-57200	7.5 HIGH	Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and c
CVE-2026-57186	7.5 HIGH	Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
CVE-2026-57185	6.5 MEDIUM	Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
CVE-2026-57194	5.9 MEDIUM	Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asteris
CVE-2026-57198	2.3 LOW	Asterisk: Possible RED T.140 Heap Buffer Overflow
CVE-2026-57189	2.3 LOW	Asterisk: Possible RED T.140 Generation Accumulation OOB Write

IV. Related Vulnerabilities

Same product: asterisk

Same vendor: asterisk

Same weakness: CWE-787