Read the docs
TI-2026-81563 Aliases CVE-2026-57191

Stack buffer overflow in Asterisk MWI NOTIFY parsing

Priority MEDIUM 42CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

Asterisk before 20.20.1, from 21.0.0-pre1 before 21.12.3, from 22.0.0-pre1 before 22.10.1 and from 23.0.0-pre1 before 23.4.1, and Certified Asterisk before 20.7-cert11 and from 22.8-cert1-pre1 before 22.8-cert3, are affected. An unbounded sscanf in res_pjsip_pubsub, when parsing the Message-Account field of MWI NOTIFY, overflows a stack buffer (CWE-120). An unauthenticated remote attacker sends a crafted packet that corrupts the transport, disabling all SIP until Asterisk restarts.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00592 48th percentileScored 2026-11-07
Fix Fixed asterisk (asterisk): 20.20.1, 21.12.3, 22.10.1 +1certified-asterisk (asterisk): 20.7-cert11, 22.8-cert3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
asteriskasteriskbefore 20.20.1; 21.0.0-pre1 to before 21.12.3; 22.0.0-pre1 to before 22.10.1; 23.0.0-pre1 to before 23.4.120.20.1, 21.12.3, 22.10.1, 23.4.1Patch availableCNA
asteriskcertified-asteriskbefore 20.7-cert11; 22.8-cert1-pre1 to before 22.8-cert320.7-cert11, 22.8-cert3Patch availableCNA
  • asterisk Vendorasterisk Affected before 20.20.1; 21.0.0-pre1 to before 21.12.3; 22.0.0-pre1 to before 22.10.1; 23.0.0-pre1 to before 23.4.1 Fixed in 20.20.1, 21.12.3, 22.10.1, 23.4.1 Patch available CNA
  • certified-asterisk Vendorasterisk Affected before 20.7-cert11; 22.8-cert1-pre1 to before 22.8-cert3 Fixed in 20.7-cert11, 22.8-cert3 Patch available CNA

Remediation

Upgrade Asterisk to 20.20.1, 21.12.3, 22.10.1 or 23.4.1, and Certified Asterisk to 20.7-cert11 or 22.8-cert3.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA asterisk (asterisk) Fixed in 20.20.1, 21.12.3, 22.10.1, 23.4.1
  • Fix · CNA certified-asterisk (asterisk) Fixed in 20.7-cert11, 22.8-cert3

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-57191
  2. 2026-10-28 Priority changed: MEDIUM → LOW
  3. 2026-11-02 CISA SSVC decision points changed
  4. 2026-11-02 Priority changed: LOW → MEDIUM
  5. 2026-11-03 Affected versions changed · Red Hat
  6. 2026-11-03 CVSS score added · Red Hat

References

Other 15

  • TI-2025-30244 Using malformed From header can forge identity with ";" or NULL in name portion CVSS 3.1HIGH 7.7
  • TI-2023-27195 Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
  • TI-2024-28351 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan CVSS 3.1HIGH 8.8
  • TI-2025-00959 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation CVSS 4.0HIGH 7.0
  • TI-2025-34699 Asterisk remotely exploitable leak of RTP UDP ports and internal resources CVSS 3.1MEDIUM 6.5
  • TI-2025-31747 Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation CVSS 3.1MEDIUM 6.5
See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences