High severity · published Oct 27, 2026
CVE-2026-57191
Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing
New
8.2
CVSS
–
EPSS
No
On KEV
Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
asterisk · asterisk
< 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 · source: vendor
CE
certified-asterisk · asterisk
< 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57191
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57191
github.com
https://github.com/asterisk/asterisk/commit/0e89514084490070c5ecee419ec5ee37b7c49528
github.com
https://github.com/asterisk/asterisk/commit/647b35c3cfd4a2cc3b1fb7560b085feba5c24b4b
github.com
https://github.com/asterisk/asterisk/commit/7a1ffcdf38cc76d1c4eae51651667f3fd4548ab0
github.com
https://github.com/asterisk/asterisk/commit/b4be3bd67ce4ac35b94fbfa860cdd9e1c906610b
github.com
https://github.com/asterisk/asterisk/commit/b5281828dad7d44658439ba6393fe6be3328a4bd
github.com
https://github.com/asterisk/asterisk/commit/dca516f6d895e8867d48fa56b6ce7f05b6f7457a
More from asterisk
8.8
CVE-2024-42365
Asterisk is an open source private branch exchange (PBX) and telephony toolkit
8.1
CVE-2026-57202
Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
7.7
CVE-2026-57197
Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
7.5
CVE-2026-57186
Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
7.5
CVE-2026-57200
Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE