What’s Vulnerable › Vulnerabilities

CVE-2026-57184: Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)

• Severity: medium (CVSS 6.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-26 · updated 2026-10-29
• Weakness: CWE-125

Description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `information-element parser` permits an `out-of-bounds read` that may allow an unauthenticated attacker to crash Asterisk using carefully crafted `setup packets`. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected products

• asterisk: before 20.20.1; from 21.0.0-pre1, < 21.12.3; from 22.0.0-pre1, < 22.10.1; from 23.0.0-pre1, < 23.4.1
• asterisk certified-asterisk: before 20.7-cert11; from 22.8-cert1-pre1, < 22.8-cert3

References

• https://github.com/asterisk/asterisk/commit/00ebdfbc89ed160ae45a2fc0f67f36e36dae48ee
• https://github.com/asterisk/asterisk/commit/437d17fb13503fe9b4e72c35396f0c250d30b0f0
• https://github.com/asterisk/asterisk/commit/6dba027f8aea35bf3bbd89371a0cf516b13f8588
• https://github.com/asterisk/asterisk/commit/9c776e348374a72589cf27f635cddef45a2a2b90
• https://github.com/asterisk/asterisk/commit/ad4a2b3e944afd5a8e9a550bd5f62aeac8680711
• https://github.com/asterisk/asterisk/commit/b1284510421a29c72fc4e9a31e4b1e0666a0144f
• https://github.com/asterisk/asterisk/releases/tag/20.20.1
• https://github.com/asterisk/asterisk/releases/tag/21.12.3
• https://github.com/asterisk/asterisk/releases/tag/22.10.1
• https://github.com/asterisk/asterisk/releases/tag/23.4.1
• https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11
• https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3

Get alerted when CVE-2026-57184 or the next vulnerability affects your stack