All vulnerabilities
CVE-2026-57191GHSA-589g-qgf8-m6mx

Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing

asterisk asterisk
Open in ThreatlineRecord JSON
CVSS
8.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in20.20.1Also 21.12.3, 22.10.1 and 3 moreGitHub
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

  • 20.20.1asterisk, otherGitHub
  • 21.12.3asterisk, otherGitHub
  • 22.10.1asterisk, otherGitHub
  • 23.4.1asterisk, otherGitHub
  • 20.7-cert11certified-asterisk, otherGitHub
  • 22.8-cert3certified-asterisk, otherGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded sscanf in res_pjsip_pubsub when parsing the MWI NOTIFY Message-Account field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Text from CVE List

Affected versions 12

  • asteriskaffected: < 20.20.1CVE List
  • asteriskaffected: >= 21.0.0-pre1, < 21.12.3CVE List
  • asteriskaffected: >= 22.0.0-pre1, < 22.10.1CVE List
  • asteriskaffected: >= 23.0.0-pre1, < 23.4.1CVE List
  • certified-asteriskaffected: < 20.7-cert11CVE List
  • certified-asteriskaffected: >= 22.8-cert1-pre1, < 22.8-cert3CVE List
  • asterisk, other<= 20.20.0GitHub
  • asterisk, other<= 21.12.2GitHub
  • asterisk, other<= 22.10.0GitHub
  • asterisk, other<= 23.4.0GitHub
  • certified-asterisk, other<= 20.7-cert10GitHub
  • certified-asterisk, other<= 22.8-cert2GitHub

References 15