{"id":"CVE-2026-57198","title":"Asterisk: Possible RED T.140 Heap Buffer Overflow","summary":"Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` heap buffer overflow using carefully crafted packets, potentially allowing remote code e…","severity":"low","cvss":2.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-122"],"vendor":"asterisk","product":"asterisk","affected":["asterisk < 20.20.1","asterisk >= 21.0.0-pre1, < 21.12.3","asterisk >= 22.0.0-pre1, < 22.10.1","asterisk >= 23.0.0-pre1, < 23.4.1","certified-asterisk < 20.7-cert11","certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T16:47:20.717Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-57198","references":[{"url":"https://github.com/asterisk/asterisk/security/advisories/GHSA-vfhr-r9x9-c687","label":"https://github.com/asterisk/asterisk/security/advisories/GHSA-vfhr-r9x9-c687"},{"url":"https://github.com/asterisk/asterisk/commit/0601c33d4edf8c8f221de91cead59460fb1e7180","label":"https://github.com/asterisk/asterisk/commit/0601c33d4edf8c8f221de91cead59460fb1e7180"},{"url":"https://github.com/asterisk/asterisk/commit/111487298a954a029daae941eac423f0609b1261","label":"https://github.com/asterisk/asterisk/commit/111487298a954a029daae941eac423f0609b1261"},{"url":"https://github.com/asterisk/asterisk/commit/536218a86b797996e8e8844deacc8207de373701","label":"https://github.com/asterisk/asterisk/commit/536218a86b797996e8e8844deacc8207de373701"},{"url":"https://github.com/asterisk/asterisk/commit/a89b61d7c756f816c7fa5327ead9e889f1531202","label":"https://github.com/asterisk/asterisk/commit/a89b61d7c756f816c7fa5327ead9e889f1531202"},{"url":"https://github.com/asterisk/asterisk/commit/eaa108c68a32c080d7a168ef1d8bf784d5d830f4","label":"https://github.com/asterisk/asterisk/commit/eaa108c68a32c080d7a168ef1d8bf784d5d830f4"},{"url":"https://github.com/asterisk/asterisk/commit/eef894282be203cb9e6d8e9692e9c360a0b569b4","label":"https://github.com/asterisk/asterisk/commit/eef894282be203cb9e6d8e9692e9c360a0b569b4"},{"url":"https://github.com/asterisk/asterisk/commit/fde69a1f3ff17f507a1578ae27b528f43ceb5efd","label":"https://github.com/asterisk/asterisk/commit/fde69a1f3ff17f507a1578ae27b528f43ceb5efd"},{"url":"https://github.com/asterisk/asterisk/releases/tag/20.20.1","label":"https://github.com/asterisk/asterisk/releases/tag/20.20.1"},{"url":"https://github.com/asterisk/asterisk/releases/tag/21.12.3","label":"https://github.com/asterisk/asterisk/releases/tag/21.12.3"},{"url":"https://github.com/asterisk/asterisk/releases/tag/22.10.1","label":"https://github.com/asterisk/asterisk/releases/tag/22.10.1"},{"url":"https://github.com/asterisk/asterisk/releases/tag/23.4.1","label":"https://github.com/asterisk/asterisk/releases/tag/23.4.1"},{"url":"https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11","label":"https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11"},{"url":"https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3","label":"https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3"},{"url":"https://github.com/asterisk/asterisk/tree/24.0.0-pre1","label":"https://github.com/asterisk/asterisk/tree/24.0.0-pre1"}],"tags":["cve.org"],"ingestedAt":"2026-10-27T17:33:23.794Z","slug":"CVE-2026-57198","body":"## Overview\n\nAsterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured, and its `textsupport` option must be enabled; `textsupport` defaults to no. `The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions.` Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required `chan_sip` driver was removed there.\n\n## Affected\n\n- `asterisk < 20.20.1`\n- `asterisk >= 21.0.0-pre1, < 21.12.3`\n- `asterisk >= 22.0.0-pre1, < 22.10.1`\n- `asterisk >= 23.0.0-pre1, < 23.4.1`\n- `certified-asterisk < 20.7-cert11`\n- `certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":13,"depthScoreParts":{"impact":12.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}