Medium severity · published Oct 27, 2026
CVE-2026-57194
Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
New
5.9
CVSS
–
EPSS
No
On KEV
Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an out-of-bounds write in `chan_unistim` `DIALPAGE` digit handling can overflow the `phone_number` field and crash Asterisk when an attacker sends a carefully crafted incoming request packet. The `chan_unistim` module must be loaded and configured with a valid `UNISTIM UDP port` that the attacker can reach. The attacker must register as a configured `phone MAC`, or the deployment must have an equivalent `production/autoprovisioning` path that allows the client to reach the main page. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
asterisk · asterisk
< 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 · source: vendor
CE
certified-asterisk · asterisk
< 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57194
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57194
github.com
https://github.com/asterisk/asterisk/commit/430f423c84e4e32a462d907632b66c9793236e96
github.com
https://github.com/asterisk/asterisk/commit/6da8e10c210d8e014c27c67235252e1dfc794446
github.com
https://github.com/asterisk/asterisk/commit/6f414ec771eaa3318a4b2d28f70fa387196ae283
github.com
https://github.com/asterisk/asterisk/commit/ce6e2233599b76bc30c33b4816b15609c8ddc8b6
github.com
https://github.com/asterisk/asterisk/commit/d803b5370b05f39a6241b2556eb9894b02148e6a
github.com
https://github.com/asterisk/asterisk/commit/fc3a1cb3c386c962bfca8cd9d533d1390d4ad933
More from asterisk
8.8
CVE-2024-42365
Asterisk is an open source private branch exchange (PBX) and telephony toolkit
8.2
CVE-2026-57191
Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing
8.1
CVE-2026-57202
Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
7.7
CVE-2026-57197
Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
7.5
CVE-2026-57186
Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser