Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-57189— Asterisk: Possible RED T.140 Generation Accumulation OOB Write

Quick assessment

Affected
asterisk asterisk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Asterisk 是一个开源的专用分支交换（PBX）和电话工具包。在受影响的部署中，经过身份验证的攻击者可通过精心构造的数据包，在“生成累积”过程中触发 越界写入漏洞，可能导致远程代码执行或使 Asterisk 崩溃。该漏洞需要安装并配置 通道驱动，且其 选项必须启用；该选项的默认值为“否”。 驱动已在 Asterisk 20 中被弃用，并在所有后续版本中完全移除。通过代码库比对确认，以下版本已包含修复补丁：Asterisk 20.20.1、21.12.3、22.10.1、23.4.1，以及经过认证的 Certif

CVSS 2.3 · Low

Affected Version Matrix 6

VendorProduct Version RangeStatus
asterisk asterisk < 20.20.1 affected
>= 21.0.0-pre1, < 21.12.3 affected
>= 22.0.0-pre1, < 22.10.1 affected
>= 23.0.0-pre1, < 23.4.1 affected
asterisk certified-asterisk < 20.7-cert11 affected
>= 22.8-cert1-pre1, < 22.8-cert3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-57189

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Asterisk: Possible RED T.140 Generation Accumulation OOB Write
Source: CVE Program / CVE List V5
Vulnerability Description
Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` out-of-bounds write during `generation accumulation` using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured, and its `textsupport` option must be enabled; `textsupport` defaults to no. `The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions.` Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required `chan_sip` driver was removed there.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
asterisk asterisk < 20.20.1 -
asterisk certified-asterisk < 20.7-cert11 -

II. Public POCs for CVE-2026-57189

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-57189

请登录查看更多情报信息。

Vendor Pages for CVE-2026-57189 (7)

Other References for CVE-2026-57189 (8)

Same Patch Batch · asterisk · 2026-10-27 · 8 CVEs total

CVE-2026-57202 8.1 HIGH Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
CVE-2026-57197 7.7 HIGH Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
CVE-2026-57201 7.5 HIGH Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-
CVE-2026-57188 7.1 HIGH Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
CVE-2026-57185 6.5 MEDIUM Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
CVE-2026-57194 5.9 MEDIUM Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asteris
CVE-2026-57198 2.3 LOW Asterisk: Possible RED T.140 Heap Buffer Overflow

IV. Related Vulnerabilities

Same product: asterisk
Same vendor: asterisk
Same weakness: CWE-787