High severity · published Oct 27, 2026
CVE-2026-57201
Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
New
7.5
CVSS
–
EPSS
No
On KEV
Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 `ooTrace()` trace-logging function can occur when unbounded `vsprintf` writes into a fixed `2048-byte buffer`. A remote attacker may send a carefully crafted packet that causes the Asterisk process to crash. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
asterisk · asterisk
< 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 · source: vendor
CE
certified-asterisk · asterisk
< 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57201
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57201
github.com
https://github.com/asterisk/asterisk/commit/2d7b8c8dc13d9ead8b6f36cc38b6dd91cd4abd3a
github.com
https://github.com/asterisk/asterisk/commit/33f62e351642edd9c58ef97b0002132722546af9
github.com
https://github.com/asterisk/asterisk/commit/875ac7413de0b7068cd12d0da2f140cd06ba9357
github.com
https://github.com/asterisk/asterisk/commit/ac0a64dec6d4231bf005a68da6af3e02bb311634
github.com
https://github.com/asterisk/asterisk/commit/bf0c9a906892bc0f91fa753476e326919e4e30e5
github.com
https://github.com/asterisk/asterisk/commit/c4d9b4defe83f74523880fd630c02c49683786a3
More from asterisk
8.8
CVE-2024-42365
Asterisk is an open source private branch exchange (PBX) and telephony toolkit
8.2
CVE-2026-57191
Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing
8.1
CVE-2026-57202
Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
7.7
CVE-2026-57197
Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
7.5
CVE-2026-57186
Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser