Medium severity · published Oct 26, 2026
CVE-2026-57184
Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
New
6.3
CVSS
0.6%
EPSS
No
On KEV
Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `information-element parser` permits an `out-of-bounds read` that may allow an unauthenticated attacker to crash Asterisk using carefully crafted `setup packets`. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
asterisk · asterisk
< 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 · source: vendor
CE
certified-asterisk · asterisk
< 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57184
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57184
github.com
https://github.com/asterisk/asterisk/commit/00ebdfbc89ed160ae45a2fc0f67f36e36dae48ee
github.com
https://github.com/asterisk/asterisk/commit/437d17fb13503fe9b4e72c35396f0c250d30b0f0
github.com
https://github.com/asterisk/asterisk/commit/6dba027f8aea35bf3bbd89371a0cf516b13f8588
github.com
https://github.com/asterisk/asterisk/commit/9c776e348374a72589cf27f635cddef45a2a2b90
github.com
https://github.com/asterisk/asterisk/commit/ad4a2b3e944afd5a8e9a550bd5f62aeac8680711
github.com
https://github.com/asterisk/asterisk/commit/b1284510421a29c72fc4e9a31e4b1e0666a0144f
More from asterisk
8.8
CVE-2024-42365
Asterisk is an open source private branch exchange (PBX) and telephony toolkit
8.2
CVE-2026-57191
Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing
8.1
CVE-2026-57202
Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
7.7
CVE-2026-57197
Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
7.5
CVE-2026-57186
Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser