CVE-2026-57186

Name of the Vulnerable Software and Affected Versions Asterisk versions 21.0.0-pre1 through 21.12.2 Asterisk versions 22.0.0 through 22.10.0 Asterisk versions 23.0.0 through 23.4.0 Certified Asterisk versions prior to 22.8-cert3

Description The chan ooh323 Q.931 party-number parser fails to properly handle malformed Q.931 elements within an OOH323 request, which can lead to a system crash. This issue occurs because a previous fix was not forward-ported to versions greater than 20. Exploitation requires the chan ooh323 addon channel driver to be explicitly compiled, installed, and its port to be publicly reachable.

Recommendations Update to version 21.12.3 Update to version 22.10.1 Update to version 23.4.1 Update to Certified Asterisk version 22.8-cert3 As a temporary workaround, avoid compiling or installing the chan ooh323 addon channel driver.