Stack buffer overflow in Asterisk H.323 ooTrace() crashes the process
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
Asterisk, an open source private branch exchange and telephony toolkit, has a stack buffer overflow in the H.323 ooTrace() trace logging function (CWE-787). Unbounded vsprintf calls write past a fixed 2048 byte buffer. A remote attacker can send a crafted packet that crashes the Asterisk process, if the chan_ooh323 addon driver is installed and its port is publicly reachable.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 `ooTrace()` trace-logging function can occur when unbounded `vsprintf` writes into a fixed `2048-byte buffer`. A remote attacker may send a carefully crafted packet that causes the Asterisk process to crash. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| asterisk | asterisk | before 20.20.1; 21.0.0-pre1 to before 21.12.3; 22.0.0-pre1 to before 22.10.1; 23.0.0-pre1 to before 23.4.1 | 20.20.1, 21.12.3, 22.10.1, 23.4.1 | Patch available | CNA |
| asterisk | certified-asterisk | before 20.7-cert11; 22.8-cert1-pre1 to before 22.8-cert3 | 20.7-cert11, 22.8-cert3 | Patch available | CNA |
- asterisk Vendorasterisk Affected before 20.20.1; 21.0.0-pre1 to before 21.12.3; 22.0.0-pre1 to before 22.10.1; 23.0.0-pre1 to before 23.4.1 Fixed in 20.20.1, 21.12.3, 22.10.1, 23.4.1 Patch available CNA
- certified-asterisk Vendorasterisk Affected before 20.7-cert11; 22.8-cert1-pre1 to before 22.8-cert3 Fixed in 20.7-cert11, 22.8-cert3 Patch available CNA
Remediation
Upgrade Asterisk to 20.20.1, 21.12.3, 22.10.1 or 23.4.1, or Certified Asterisk to 20.7-cert11 or 22.8-cert3.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA asterisk (asterisk) Fixed in 20.20.1, 21.12.3, 22.10.1, 23.4.1
- Fix · CNA certified-asterisk (asterisk) Fixed in 20.7-cert11, 22.8-cert3
Vendor assessments
Timeline
- 2026-10-27 Threatist record created from CVE-2026-57201
- 2026-10-28 Priority changed: MEDIUM → LOW
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Priority changed: LOW → MEDIUM
- 2026-11-02 Affected versions changed · Red Hat
- 2026-11-02 CVSS score added · Red Hat
References
Other 15
- https://github.com/asterisk/asterisk/security/advisories/GHSA-x348-j6c9-77f3
- https://github.com/asterisk/asterisk/commit/2d7b8c8dc13d9ead8b6f36cc38b6dd91cd4abd3a
- https://github.com/asterisk/asterisk/commit/33f62e351642edd9c58ef97b0002132722546af9
- https://github.com/asterisk/asterisk/commit/875ac7413de0b7068cd12d0da2f140cd06ba9357
- https://github.com/asterisk/asterisk/commit/ac0a64dec6d4231bf005a68da6af3e02bb311634
- https://github.com/asterisk/asterisk/commit/bf0c9a906892bc0f91fa753476e326919e4e30e5
- https://github.com/asterisk/asterisk/commit/c4d9b4defe83f74523880fd630c02c49683786a3
- https://github.com/asterisk/asterisk/commit/fff256d0539e96f70ac315844d72e9d540f03a4c
- https://github.com/asterisk/asterisk/releases/tag/20.20.1
- https://github.com/asterisk/asterisk/releases/tag/21.12.3
- https://github.com/asterisk/asterisk/releases/tag/22.10.1
- https://github.com/asterisk/asterisk/releases/tag/23.4.1
- https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11
- https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3
- https://github.com/asterisk/asterisk/tree/24.0.0-pre1
More asterisk vulnerabilities
- TI-2025-30244 Using malformed From header can forge identity with ";" or NULL in name portion CVSS 3.1HIGH 7.7
- TI-2023-27195 Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
- TI-2024-28351 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan CVSS 3.1HIGH 8.8
- TI-2025-00959 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation CVSS 4.0HIGH 7.0
- TI-2025-34699 Asterisk remotely exploitable leak of RTP UDP ports and internal resources CVSS 3.1MEDIUM 6.5
- TI-2025-31747 Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-57201 · CVE Program
- CVE-2026-57201 · NVD
- FIRST EPSS
- CVE-2026-57201 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences