CVE-2026-57191

Received Received - Intake

Stack Buffer Overflow in Asterisk SIP Functionality

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-27

Last Modified

2026-10-27

Generated

2026-10-28

AI Q&A

2026-10-28

EPSS Evaluated

N/A

NVD

CVE-2026-57191

EUVD

EUVD-2026-111397

Affected Vendors & Products

Vendor	Product	Version / Range
asterisk	asterisk	< 20.20.1
asterisk	asterisk	>= 21.0.0-pre1, < 21.12.3
asterisk	asterisk	>= 22.0.0-pre1, < 22.10.1
asterisk	asterisk	>= 23.0.0-pre1, < 23.4.1
asterisk	certified-asterisk	< 20.7-cert11
asterisk	certified-asterisk	>= 22.8-cert1-pre1, < 22.8-cert3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

Asterisk is vulnerable to a stack buffer overflow in the res_pjsip_pubsub module when parsing the Message-Account field in MWI NOTIFY SIP packets. An unauthenticated attacker can exploit this by sending a specially crafted packet, causing a buffer overflow that corrupts the SIP transport layer and permanently disables all SIP functionality. A restart is required to restore service.

Detection Guidance

This vulnerability can be detected by checking the Asterisk version running on your system. Compare it against the patched versions (20.20.1, 21.12.3, 22.10.1, 23.4.1, Certified Asterisk 20.7-cert11, 22.8-cert3). Use commands like 'asterisk -V' or 'asterisk -rx "core show version"' to check the version.

Impact Analysis

This vulnerability allows an attacker to disrupt all SIP telephony services by crashing the Asterisk server. This results in complete loss of voice communication, call routing, and voicemail services until the server is manually restarted. No authentication is required for exploitation.

Mitigation Strategies

Immediately upgrade Asterisk to a patched version (20.20.1, 21.12.3, 22.10.1, 23.4.1, Certified Asterisk 20.7-cert11, 22.8-cert3). If upgrading is not possible, restrict network access to SIP ports and disable MWI NOTIFY handling as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-57191. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70