CVE-2026-57198 in Asterisk
Summary
by MITRE • 10/27/2026
Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured, and its `textsupport` option must be enabled; `textsupport` defaults to no. `The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions.` Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required `chan_sip` driver was removed there.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/27/2026
Asterisk, a widely deployed open-source private branch exchange and telephony toolkit, contains a critical vulnerability within its legacy Session Initiation Protocol channel driver that allows for remote code execution or denial of service under specific configuration conditions. The flaw resides in the handling of T.140 RED packets, which are used to transmit real-time text data during voice calls. An authenticated attacker who has valid credentials on the Asterisk system can exploit this vulnerability by sending carefully crafted network packets that trigger a heap buffer overflow within the chan_sip module. This memory corruption issue arises because the software fails to properly validate or bound-check input data when processing these specific telephony signaling messages, leading to arbitrary write operations in memory.
The technical nature of this flaw is classified as CWE-122, which denotes a heap-based buffer overflow where an attacker can overwrite adjacent memory structures due to insufficient bounds checking during the parsing of incoming T.140 RED data. The operational impact is severe, potentially granting the attacker full control over the affected server through remote code execution or causing immediate service disruption via application crash. However, exploitation requires that the chan_sip channel driver be both installed and actively configured with the textsupport option enabled. It is important to note that this configuration setting defaults to disabled in standard installations, which provides a layer of default security for many deployments but does not protect those explicitly enabling real-time text features over SIP.
From an industry standards perspective, this vulnerability aligns with MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques if the overflow is leveraged to execute arbitrary commands, or T1498 Network Denial of Service if used solely for crashing the service. The presence of authentication requirements places this in a context where an insider threat or compromised credentials are necessary prerequisites, distinguishing it from unauthenticated remote exploits but still posing significant risk within trusted network segments.
Mitigation strategies must focus on both configuration hardening and software lifecycle management. Administrators should immediately disable the textsupport option for chan_sip if real-time text functionality is not strictly required by their telephony applications. Furthermore, since the chan_sip driver was deprecated in Asterisk version 20 and completely removed in all subsequent major releases, upgrading to a modern version of Asterisk that utilizes the chan_pjsip channel driver effectively eliminates this attack vector entirely. For organizations unable to upgrade immediately, applying the specific patches identified for release tracks 20.20.1, 21.12.3, 22.10.1, and 23.4.1 is essential. Additionally, Certified Asterisk versions 20.7-cert11 and 22.8-cert3 also contain the necessary fixes for this issue.
There remains some ambiguity regarding later release tracks where structured metadata suggests ongoing vulnerability presence despite advisories stating that chan_sip was removed in newer versions. This discrepancy highlights the importance of verifying patch containment through repository comparisons rather than relying solely on version number heuristics. Organizations should audit their current Asterisk installations to confirm they are running patched versions or have migrated away from the deprecated chan_sip driver entirely, ensuring that any residual configuration remnants do not expose them to this heap overflow risk.