Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-57201— Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer

Quick assessment

Affected
asterisk asterisk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Asterisk 是一款开源的专用小交换机（PBX）和电话系统工具包。在 Asterisk 20.20.1、21.12.3、22.10.1、23.4.1 以及认证版 Asterisk 20.7-cert11、22.8-cert3 之前的版本中，H.323 协议栈的 跟踪日志函数存在栈缓冲区溢出漏洞。该漏洞源于无界 写入操作将数据写入一个固定大小为 2048 字节的缓冲区。远程攻击者可发送精心构造的数据包，导致 Asterisk 进程崩溃。触发此漏洞需要显式编译并安装 附加通道驱动模块（该模块默认未启用），且其监听端

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 6

VendorProduct Version RangeStatus
asterisk asterisk < 20.20.1 affected
>= 21.0.0-pre1, < 21.12.3 affected
>= 22.0.0-pre1, < 22.10.1 affected
>= 23.0.0-pre1, < 23.4.1 affected
asterisk certified-asterisk < 20.7-cert11 affected
>= 22.8-cert1-pre1, < 22.8-cert3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-57201

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
Source: CVE Program / CVE List V5
Vulnerability Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 `ooTrace()` trace-logging function can occur when unbounded `vsprintf` writes into a fixed `2048-byte buffer`. A remote attacker may send a carefully crafted packet that causes the Asterisk process to crash. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
asterisk asterisk < 20.20.1 -
asterisk certified-asterisk < 20.7-cert11 -

II. Public POCs for CVE-2026-57201

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-57201

请登录查看更多情报信息。

Vendor Pages for CVE-2026-57201 (7)

Other References for CVE-2026-57201 (8)

Same Patch Batch · asterisk · 2026-10-27 · 8 CVEs total

CVE-2026-57202 8.1 HIGH Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
CVE-2026-57197 7.7 HIGH Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
CVE-2026-57188 7.1 HIGH Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
CVE-2026-57185 6.5 MEDIUM Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
CVE-2026-57194 5.9 MEDIUM Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asteris
CVE-2026-57198 2.3 LOW Asterisk: Possible RED T.140 Heap Buffer Overflow
CVE-2026-57189 2.3 LOW Asterisk: Possible RED T.140 Generation Accumulation OOB Write

IV. Related Vulnerabilities

Same product: asterisk
Same vendor: asterisk
Same weakness: CWE-787