---
id: CVE-2026-57191
title: 'Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing'
summary: >-
  Asterisk is an open source private branch exchange and telephony toolkit.
  Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk
  20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when
  parsing the `M…
severity: high
cvss: 8.2
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-120
  - CWE-787
vendor: asterisk
product: asterisk
affected:
  - asterisk < 20.20.1
  - 'asterisk >= 21.0.0-pre1, < 21.12.3'
  - 'asterisk >= 22.0.0-pre1, < 22.10.1'
  - 'asterisk >= 23.0.0-pre1, < 23.4.1'
  - certified-asterisk < 20.7-cert11
  - 'certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3'
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T21:32:23.714Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-57191'
references:
  - url: >-
      https://github.com/asterisk/asterisk/security/advisories/GHSA-589g-qgf8-m6mx
    label: >-
      https://github.com/asterisk/asterisk/security/advisories/GHSA-589g-qgf8-m6mx
  - url: >-
      https://github.com/asterisk/asterisk/commit/0e89514084490070c5ecee419ec5ee37b7c49528
    label: >-
      https://github.com/asterisk/asterisk/commit/0e89514084490070c5ecee419ec5ee37b7c49528
  - url: >-
      https://github.com/asterisk/asterisk/commit/647b35c3cfd4a2cc3b1fb7560b085feba5c24b4b
    label: >-
      https://github.com/asterisk/asterisk/commit/647b35c3cfd4a2cc3b1fb7560b085feba5c24b4b
  - url: >-
      https://github.com/asterisk/asterisk/commit/7a1ffcdf38cc76d1c4eae51651667f3fd4548ab0
    label: >-
      https://github.com/asterisk/asterisk/commit/7a1ffcdf38cc76d1c4eae51651667f3fd4548ab0
  - url: >-
      https://github.com/asterisk/asterisk/commit/b4be3bd67ce4ac35b94fbfa860cdd9e1c906610b
    label: >-
      https://github.com/asterisk/asterisk/commit/b4be3bd67ce4ac35b94fbfa860cdd9e1c906610b
  - url: >-
      https://github.com/asterisk/asterisk/commit/b5281828dad7d44658439ba6393fe6be3328a4bd
    label: >-
      https://github.com/asterisk/asterisk/commit/b5281828dad7d44658439ba6393fe6be3328a4bd
  - url: >-
      https://github.com/asterisk/asterisk/commit/dca516f6d895e8867d48fa56b6ce7f05b6f7457a
    label: >-
      https://github.com/asterisk/asterisk/commit/dca516f6d895e8867d48fa56b6ce7f05b6f7457a
  - url: >-
      https://github.com/asterisk/asterisk/commit/ee1b66a5e40733ba0b9fad7fc4d032cabbe1dd75
    label: >-
      https://github.com/asterisk/asterisk/commit/ee1b66a5e40733ba0b9fad7fc4d032cabbe1dd75
  - url: 'https://github.com/asterisk/asterisk/releases/tag/20.20.1'
    label: 'https://github.com/asterisk/asterisk/releases/tag/20.20.1'
  - url: 'https://github.com/asterisk/asterisk/releases/tag/21.12.3'
    label: 'https://github.com/asterisk/asterisk/releases/tag/21.12.3'
  - url: 'https://github.com/asterisk/asterisk/releases/tag/22.10.1'
    label: 'https://github.com/asterisk/asterisk/releases/tag/22.10.1'
  - url: 'https://github.com/asterisk/asterisk/releases/tag/23.4.1'
    label: 'https://github.com/asterisk/asterisk/releases/tag/23.4.1'
  - url: 'https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11'
    label: 'https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11'
  - url: 'https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3'
    label: 'https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3'
  - url: 'https://github.com/asterisk/asterisk/tree/24.0.0-pre1'
    label: 'https://github.com/asterisk/asterisk/tree/24.0.0-pre1'
tags:
  - cve.org
ingestedAt: '2026-10-27T21:58:08.782Z'
---

## Overview

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

## Affected

- `asterisk < 20.20.1`
- `asterisk >= 21.0.0-pre1, < 21.12.3`
- `asterisk >= 22.0.0-pre1, < 22.10.1`
- `asterisk >= 23.0.0-pre1, < 23.4.1`
- `certified-asterisk < 20.7-cert11`
- `certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.