Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-57194— Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk

Quick assessment

Affected
asterisk asterisk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Asterisk 是一款开源的专用交换机（PBX）和电话通信工具包。在以下版本之前：Asterisk 20.20.1、21.12.3、22.10.1、23.4.1，以及认证版 Asterisk 20.7-cert11、22.8-cert3， 模块在处理 数字时存在越界写入漏洞。攻击者若发送精心构造的入站请求数据包，可能导致 字段溢出，进而引发 Asterisk 服务崩溃。触发该漏洞需满足以下条件： 模块必须已加载，并配置了攻击者可访问的有效 ；此外，攻击者需以已配置的 注册，或部署环境需具备等效的“生产/自动配置”

CVSS 5.9 · Medium

Affected Version Matrix 6

VendorProduct Version RangeStatus
asterisk asterisk < 20.20.1 affected
>= 21.0.0-pre1, < 21.12.3 affected
>= 22.0.0-pre1, < 22.10.1 affected
>= 23.0.0-pre1, < 23.4.1 affected
asterisk certified-asterisk < 20.7-cert11 affected
>= 22.8-cert1-pre1, < 22.8-cert3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-57194

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
Source: CVE Program / CVE List V5
Vulnerability Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an out-of-bounds write in `chan_unistim` `DIALPAGE` digit handling can overflow the `phone_number` field and crash Asterisk when an attacker sends a carefully crafted incoming request packet. The `chan_unistim` module must be loaded and configured with a valid `UNISTIM UDP port` that the attacker can reach. The attacker must register as a configured `phone MAC`, or the deployment must have an equivalent `production/autoprovisioning` path that allows the client to reach the main page. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
asterisk asterisk < 20.20.1 -
asterisk certified-asterisk < 20.7-cert11 -

II. Public POCs for CVE-2026-57194

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-57194

请登录查看更多情报信息。

Vendor Pages for CVE-2026-57194 (7)

Other References for CVE-2026-57194 (8)

Same Patch Batch · asterisk · 2026-10-27 · 8 CVEs total

CVE-2026-57202 8.1 HIGH Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
CVE-2026-57197 7.7 HIGH Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
CVE-2026-57201 7.5 HIGH Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-
CVE-2026-57188 7.1 HIGH Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
CVE-2026-57185 6.5 MEDIUM Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
CVE-2026-57198 2.3 LOW Asterisk: Possible RED T.140 Heap Buffer Overflow
CVE-2026-57189 2.3 LOW Asterisk: Possible RED T.140 Generation Accumulation OOB Write

IV. Related Vulnerabilities

Same product: asterisk
Same vendor: asterisk
Same weakness: CWE-787