---
id: CVE-2026-57184
title: 'Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)'
summary: >-
  Asterisk is an open source private branch exchange and telephony toolkit.
  Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk
  20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323`
  `Q.931` `info…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-125
vendor: asterisk
product: asterisk
affected:
  - asterisk < 20.20.1
  - 'asterisk >= 21.0.0-pre1, < 21.12.3'
  - 'asterisk >= 22.0.0-pre1, < 22.10.1'
  - 'asterisk >= 23.0.0-pre1, < 23.4.1'
  - certified-asterisk < 20.7-cert11
  - 'certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-26T20:22:44.213207Z'
published: '2026-10-26'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T01:52:01.081Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-57184'
references:
  - url: >-
      https://github.com/asterisk/asterisk/security/advisories/GHSA-746q-794h-cc7f
    label: >-
      https://github.com/asterisk/asterisk/security/advisories/GHSA-746q-794h-cc7f
  - url: >-
      https://github.com/asterisk/asterisk/commit/00ebdfbc89ed160ae45a2fc0f67f36e36dae48ee
    label: >-
      https://github.com/asterisk/asterisk/commit/00ebdfbc89ed160ae45a2fc0f67f36e36dae48ee
  - url: >-
      https://github.com/asterisk/asterisk/commit/437d17fb13503fe9b4e72c35396f0c250d30b0f0
    label: >-
      https://github.com/asterisk/asterisk/commit/437d17fb13503fe9b4e72c35396f0c250d30b0f0
  - url: >-
      https://github.com/asterisk/asterisk/commit/6dba027f8aea35bf3bbd89371a0cf516b13f8588
    label: >-
      https://github.com/asterisk/asterisk/commit/6dba027f8aea35bf3bbd89371a0cf516b13f8588
  - url: >-
      https://github.com/asterisk/asterisk/commit/9c776e348374a72589cf27f635cddef45a2a2b90
    label: >-
      https://github.com/asterisk/asterisk/commit/9c776e348374a72589cf27f635cddef45a2a2b90
  - url: >-
      https://github.com/asterisk/asterisk/commit/ad4a2b3e944afd5a8e9a550bd5f62aeac8680711
    label: >-
      https://github.com/asterisk/asterisk/commit/ad4a2b3e944afd5a8e9a550bd5f62aeac8680711
  - url: >-
      https://github.com/asterisk/asterisk/commit/b1284510421a29c72fc4e9a31e4b1e0666a0144f
    label: >-
      https://github.com/asterisk/asterisk/commit/b1284510421a29c72fc4e9a31e4b1e0666a0144f
  - url: 'https://github.com/asterisk/asterisk/releases/tag/20.20.1'
    label: 'https://github.com/asterisk/asterisk/releases/tag/20.20.1'
  - url: 'https://github.com/asterisk/asterisk/releases/tag/21.12.3'
    label: 'https://github.com/asterisk/asterisk/releases/tag/21.12.3'
  - url: 'https://github.com/asterisk/asterisk/releases/tag/22.10.1'
    label: 'https://github.com/asterisk/asterisk/releases/tag/22.10.1'
  - url: 'https://github.com/asterisk/asterisk/releases/tag/23.4.1'
    label: 'https://github.com/asterisk/asterisk/releases/tag/23.4.1'
  - url: 'https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11'
    label: 'https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11'
  - url: 'https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3'
    label: 'https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3'
  - url: 'https://github.com/asterisk/asterisk/tree/24.0.0-pre1'
    label: 'https://github.com/asterisk/asterisk/tree/24.0.0-pre1'
tags:
  - cve.org
epss: 0.0056
epssPercentile: 0.46599
ingestedAt: '2026-10-26T20:39:42.626Z'
---

## Overview

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `information-element parser` permits an `out-of-bounds read` that may allow an unauthenticated attacker to crash Asterisk using carefully crafted `setup packets`. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

## Affected

- `asterisk < 20.20.1`
- `asterisk >= 21.0.0-pre1, < 21.12.3`
- `asterisk >= 22.0.0-pre1, < 22.10.1`
- `asterisk >= 23.0.0-pre1, < 23.4.1`
- `certified-asterisk < 20.7-cert11`
- `certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.