CVE-2026-57187High· 7.1▾ TwilightAsterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in `P…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVITE over a connection-oriented transport and disconnecting before Asterisk responds with the 200 OK. So far, the crash has only been reproduced when Asterisk is built with Address Sanitizer, which detects the issue. Address Sanitizer is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
asterisk < 20.20.1asterisk >= 21.0.0-pre1, < 21.12.3asterisk >= 22.0.0-pre1, < 22.10.1asterisk >= 23.0.0-pre1, < 23.4.1certified-asterisk < 20.7-cert11certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-57188High· 7.1Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
CVE-2026-57202High· 8.1Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
CVE-2026-57185Medium· 6.5Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
CVE-2026-57197High· 7.7Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
CVE-2026-57198Low· 2.3Asterisk: Possible RED T.140 Heap Buffer Overflow
CVE-2026-57194Medium· 5.9Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk