{"schema":"threatline.record/2","record":{"id":"CVE-2026-57198","aliases":["GHSA-vfhr-r9x9-c687"],"summary":"Asterisk: Possible RED T.140 Heap Buffer Overflow","details":"Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured, and its `textsupport` option must be enabled; `textsupport` defaults to no. `The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions.` Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required `chan_sip` driver was removed there.","categories":["Unclassified"],"product":"asterisk","vendor":"asterisk","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-57198","source_modified_at":"2026-10-27T16:47:20.717Z","fetched_at":"2026-10-27T21:14:11.489891Z","product":"asterisk","vendor":"asterisk","versions":[{"version":"< 20.20.1","status":"affected"},{"version":">= 21.0.0-pre1, < 21.12.3","status":"affected"},{"version":">= 22.0.0-pre1, < 22.10.1","status":"affected"},{"version":">= 23.0.0-pre1, < 23.4.1","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-57198","source_modified_at":"2026-10-27T16:47:20.717Z","fetched_at":"2026-10-27T21:14:11.489891Z","product":"certified-asterisk","vendor":"asterisk","versions":[{"version":"< 20.7-cert11","status":"affected"},{"version":">= 22.8-cert1-pre1, < 22.8-cert3","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":2.3,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T16:47:20.717Z","modified_at":"2026-10-27T16:47:20.717Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-57198","fetched_at":"2026-10-27T21:14:11.489891Z","source_modified_at":"2026-10-27T16:47:20.717Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/asterisk/asterisk/security/advisories/GHSA-vfhr-r9x9-c687","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/commit/0601c33d4edf8c8f221de91cead59460fb1e7180","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/commit/111487298a954a029daae941eac423f0609b1261","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/commit/536218a86b797996e8e8844deacc8207de373701","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/commit/a89b61d7c756f816c7fa5327ead9e889f1531202","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/commit/eaa108c68a32c080d7a168ef1d8bf784d5d830f4","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/commit/eef894282be203cb9e6d8e9692e9c360a0b569b4","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/commit/fde69a1f3ff17f507a1578ae27b528f43ceb5efd","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/releases/tag/20.20.1","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/releases/tag/21.12.3","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/releases/tag/22.10.1","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/releases/tag/23.4.1","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/asterisk/asterisk/tree/24.0.0-pre1","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T16:47:20.717Z","content_hash":"7e6e3dbcc52fcd507d1ba158c8f5ba8b0121a70c5c9dc1f7470c719fda94fd24"}}