Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-57199EUVD-2026-111403GHSA-Q9FR-M7G8-6PH5

Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 20.20.1, 21.12.3, 22.10.1, 23.4.1, 20.7-cert11, and 1 more
None on Exploit-DB, Metasploit or GitHub

Summary

Asterisk, an open source telephony toolkit, is affected through its SMS dialplan application in app_sms.c, which can be exploited to corrupt memory or crash the software. The issue only applies when administrators explicitly use the SMS application and do not validate the data passed to it.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `app_sms.c` copies externally controlled `SMS` lengths into `fixed in-struct buffers` without sufficient bounds checks, allowing an attacker to corrupt memory or crash Asterisk. The administrator must explicitly use the `SMS` dialplan application, which is useful when routing calls to or from `analog devices`, and must not have ensured that data passed to the application is valid. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Timeline

  1. CVE published
  2. First seen by cve.now

Affected versions

  • asterisk asterisk

    fixed in 20.20.1; From 21.0.0-pre1 · fixed in 21.12.3; From 22.0.0-pre1 · fixed in 22.10.1; From 23.0.0-pre1 · fixed in 23.4.1

  • asterisk certified-asterisk

    fixed in 20.7-cert11; From 22.8-cert1-pre1 · fixed in 22.8-cert3

References 15

GitHub · asterisk/asterisk