CVE-2026-57184
Asterisk is an open source private branch exchange and telephony toolkit
- Risk score
- 47/100
- CVSS
- 6.3 v4.0
- Exploit chance (30 days)
- 0.6%
- Published
- 26 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the chan_ooh323 Q.931 information-element parser permits an out-of-bounds read that may allow an unauthenticated …
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.3 medium
References
- https://github.com/asterisk/asterisk/commit/00ebdfbc89ed160ae45a2fc0f67f36e36dae48ee
- https://github.com/asterisk/asterisk/commit/437d17fb13503fe9b4e72c35396f0c250d30b0f0
- https://github.com/asterisk/asterisk/commit/6dba027f8aea35bf3bbd89371a0cf516b13f8588
- https://github.com/asterisk/asterisk/commit/9c776e348374a72589cf27f635cddef45a2a2b90
- https://github.com/asterisk/asterisk/commit/ad4a2b3e944afd5a8e9a550bd5f62aeac8680711
- https://github.com/asterisk/asterisk/commit/b1284510421a29c72fc4e9a31e4b1e0666a0144f
- https://github.com/asterisk/asterisk/releases/tag/20.20.1
- https://github.com/asterisk/asterisk/releases/tag/21.12.3
- https://github.com/asterisk/asterisk/releases/tag/22.10.1
- https://github.com/asterisk/asterisk/releases/tag/23.4.1
Original description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `information-element parser` permits an `out-of-bounds read` that may allow an unauthenticated attacker to crash Asterisk using carefully crafted `setup packets`. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Last activity 26 Oct 2026. Patch Forecast updates every hour.