Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-57198— Asterisk: Possible RED T.140 Heap Buffer Overflow

Quick assessment

Affected
asterisk asterisk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Asterisk 是一款开源的专用分支交换机（PBX）和电话系统工具包。在受影响的部署环境中，经过身份验证的攻击者可通过构造特制的数据包，触发 堆缓冲区溢出漏洞，进而可能导致远程代码执行或造成 Asterisk 服务崩溃。该漏洞的利用前提是必须安装并配置 通道驱动，且其 选项需启用（默认值为关闭）。值得注意的是， 驱动已在 Asterisk 20 版本中被弃用，并在所有后续版本中完全移除。 通过代码库比对确认，Asterisk 20.20.1、21.12.3、22.10.1 和 23.4.1 版本，以及经过认证的

CVSS 2.3 · Low

Affected Version Matrix 6

VendorProduct Version RangeStatus
asterisk asterisk < 20.20.1 affected
>= 21.0.0-pre1, < 21.12.3 affected
>= 22.0.0-pre1, < 22.10.1 affected
>= 23.0.0-pre1, < 23.4.1 affected
asterisk certified-asterisk < 20.7-cert11 affected
>= 22.8-cert1-pre1, < 22.8-cert3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-57198

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Asterisk: Possible RED T.140 Heap Buffer Overflow
Source: CVE Program / CVE List V5
Vulnerability Description
Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured, and its `textsupport` option must be enabled; `textsupport` defaults to no. `The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions.` Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required `chan_sip` driver was removed there.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
asterisk asterisk < 20.20.1 -
asterisk certified-asterisk < 20.7-cert11 -

II. Public POCs for CVE-2026-57198

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-57198

请登录查看更多情报信息。

Vendor Pages for CVE-2026-57198 (7)

Other References for CVE-2026-57198 (8)

Same Patch Batch · asterisk · 2026-10-27 · 8 CVEs total

CVE-2026-57202 8.1 HIGH Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
CVE-2026-57197 7.7 HIGH Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
CVE-2026-57201 7.5 HIGH Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-
CVE-2026-57188 7.1 HIGH Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
CVE-2026-57185 6.5 MEDIUM Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
CVE-2026-57194 5.9 MEDIUM Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asteris
CVE-2026-57189 2.3 LOW Asterisk: Possible RED T.140 Generation Accumulation OOB Write

IV. Related Vulnerabilities

Same product: asterisk
Same vendor: asterisk
Same weakness: CWE-122