CVE-2026-57201

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 20.20.1 Asterisk versions prior to 21.12.3 Asterisk versions prior to 22.10.1 Asterisk versions prior to 23.4.1 Certified Asterisk versions prior to 20.7-cert11 Certified Asterisk versions prior to 22.8-cert3

Description A stack buffer overflow occurs in the H.323 ooTrace() trace-logging function when unbounded vsprintf writes into a fixed 2048-byte buffer. A remote attacker can send a specially crafted packet to cause the process to crash. This requires the chan ooh323 addon channel driver to be explicitly compiled, installed, and its port to be publicly reachable.

Recommendations Update to version 20.20.1 Update to version 21.12.3 Update to version 22.10.1 Update to version 23.4.1 Update to Certified Asterisk version 20.7-cert11 Update to Certified Asterisk version 22.8-cert3 As a temporary mitigation, avoid compiling or installing the chan ooh323 addon channel driver.