Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-57201EUVD-2026-111220GHSA-X348-J6C9-77F3

Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 20.20.1, 21.12.3, 22.10.1, 23.4.1, 20.7-cert11, and 1 more
None on Exploit-DB, Metasploit or GitHub

Summary

The Asterisk open source telephony toolkit, specifically its optional H.323 channel driver (chan_ooh323) when explicitly compiled and installed, along with Certified Asterisk. A remote attacker sending a specially crafted packet to a publicly reachable H.323 port could crash the Asterisk process, causing a denial of service.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 `ooTrace()` trace-logging function can occur when unbounded `vsprintf` writes into a fixed `2048-byte buffer`. A remote attacker may send a carefully crafted packet that causes the Asterisk process to crash. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Timeline

  1. CVE published
  2. First seen by cve.now

Affected versions

  • asterisk asterisk

    fixed in 20.20.1; From 21.0.0-pre1 · fixed in 21.12.3; From 22.0.0-pre1 · fixed in 22.10.1; From 23.0.0-pre1 · fixed in 23.4.1

  • asterisk certified-asterisk

    fixed in 20.7-cert11; From 22.8-cert1-pre1 · fixed in 22.8-cert3

References 15

GitHub · asterisk/asterisk