PT-2026-126695
CVE-2026-57198
·
Published
2026-10-27
·
Updated
2026-10-27
Description by
CVSS 4.0
2.3
LowMetricsAV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Asterisk versions prior to 20.20.1
Asterisk versions prior to 21.12.3
Asterisk versions prior to 22.10.1
Asterisk versions prior to 23.4.1
Certified Asterisk versions prior to 20.7-cert11
Certified Asterisk versions prior to 22.8-cert3
Description
An authenticated attacker can trigger a
T.140 RED heap buffer overflow by sending specially crafted packets. This issue may lead to remote code execution or a system crash. The flaw requires the chan sip channel driver to be installed, configured, and have the textsupport option enabled.Recommendations
Update to version 20.20.1 or later.
Update to version 21.12.3 or later.
Update to version 22.10.1 or later.
Update to version 23.4.1 or later.
Update Certified Asterisk to version 20.7-cert11 or later.
Update Certified Asterisk to version 22.8-cert3 or later.
As a temporary mitigation, disable the
textsupport option in the chan sip driver. Found an issue in the description? Have something to add? Feel free to write us 👾