CVE-2026-57191 in Asterisk
Summary
by MITRE • 10/28/2026
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in the Asterisk open source private branch exchange software represents a critical security flaw within its Session Initiation Protocol implementation, specifically affecting the res_pjsip_pubsub module which handles presence and message waiting indicator notifications. Prior to the release of versions 20.20.1, 21.12.3, 22.10.1, and 23.4.1, as well as their Certified Asterisk counterparts, the software contained an unbounded sscanf operation when parsing the Message-Account field within MWI NOTIFY packets. This technical flaw allows any unauthenticated attacker to interact with the SIP service by sending a specially crafted network packet that exploits this buffer handling deficiency. The core of the issue lies in the lack of input validation and length checking for the data extracted from the incoming SIP message, which leads directly to memory corruption on the server side.
From a technical perspective, the unbounded sscanf call results in a stack-based buffer overflow when processing excessively long or malformed Message-Account fields. This type of vulnerability is classified under CWE-120, Buffer Copy without Checking Size of Input, and often falls into the category of CWE-787 Out-of-bounds Write if it overwrites adjacent memory structures. The exploitation of this flaw does not necessarily require code execution in the traditional sense but rather focuses on data corruption that destabilizes the application state. By corrupting the underlying transport layer buffers or related stack frames, an attacker can cause a denial of service condition that is particularly severe because it permanently disables all SIP functionality for the duration of the process lifetime. This distinguishes it from transient crashes, as the internal state becomes unrecoverable without external intervention.
The operational impact of this vulnerability is significant due to its potential for remote exploitation by unauthenticated actors and the resulting complete loss of telephony services. Since Asterisk serves as a central component in many communication infrastructures, disabling SIP functionality effectively halts all voice calls, voicemail access via SIP, and presence updates that rely on the protocol. The requirement for an Asterisk restart to restore full operation introduces additional operational friction, necessitating maintenance windows or triggering automated failover mechanisms if high availability is configured. This aligns with ATT&CK technique T1499 Endpoint Denial of Service, where the attacker's goal is to disrupt service availability rather than compromise data confidentiality or integrity directly. The persistence of the denial-of-service state until a restart occurs means that any system relying on continuous SIP connectivity will experience prolonged downtime during an active attack.
Mitigation strategies primarily involve upgrading to the fixed versions mentioned in the advisory, which include Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, along with their respective Certified Asterisk releases. For organizations unable to immediately patch their production environments due to compatibility or testing constraints, temporary mitigations should focus on network-level controls. Implementing strict ingress filtering rules that limit the size of SIP message headers can prevent the oversized payloads from reaching the vulnerable sscanf function. Additionally, deploying a Web Application Firewall or Session Border Controller with deep packet inspection capabilities configured to reject malformed MWI NOTIFY packets can provide an effective layer of defense against exploitation attempts while patching efforts are underway. Regular monitoring for unusual spikes in SIP traffic or error logs related to res_pjsip_pubsub may also aid in early detection of attempted exploits.