asterisk vulnerabilities

Products

• asterisk 56
• open source 22
• certified-asterisk 19
• asterisk appliance developer kit 13
• asterisknow 13
• asterisk business edition 11
• certified asterisk 11
• s800i 7
• s800i appliance 5
• digiumphones 3
• asterisk-addons 2
• business edition 2
• zaptel 2
• appliance s800i 1
• opensource 1
• p b x 1

Latest asterisk CVEs

Newest publication first · page 1 of 4

1. CVE-2026-57199 Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers

   Published 2026-10-27

   Low·CVSS 2.3

   Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers without sufficient bounds...

2. CVE-2026-57203 Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location

   Published 2026-10-27

   Medium·CVSS 6.9

   Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, ast_loggrabber executes a Python script from the world-writable /tmp directory. An attacker already author...

3. CVE-2026-57190 Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field

   Published 2026-10-27

   High·CVSS 7.0

   Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the PostgreSQL and TDS/MSSQL Channel Event Log backends cel_pgsql and cel_tds may permit arbitrary SQL exe...

4. CVE-2026-57191 Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing

   Published 2026-10-27

   High·CVSS 8.2

   Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded sscanf in res_pjsip_pubsub when parsing the MWI NOTIFY Message-Account field may allow an una...

5. CVE-2026-57192 Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch

   Published 2026-10-27

   Medium·CVSS 6.0

   Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap buffer overflow through an out-of-bounds write in the Codec2 de...

6. CVE-2026-57186 Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser

   Published 2026-10-27

   High·CVSS 7.5

   Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the chan_ooh323 Q.931 party-number parser lacks the CVE-2022-37325 fix because that fix was never forward-ported f...

7. CVE-2026-57200 Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE

   Published 2026-10-27

   High·CVSS 7.5

   Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the Asterisk REST Interface (ARI) may, under certain condition...

8. CVE-2026-57195 Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication

   Published 2026-10-27

   High·CVSS 7.5

   Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the Asterisk Manager Interface (AMI) may allow an unauthenticated attacker t...

9. CVE-2026-57202 Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes

   Published 2026-10-27

   High·CVSS 8.1

   Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use setChannelVar to...

10. CVE-2026-57188 Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling

    Published 2026-10-27

    High·CVSS 7.1

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in res_xmpp XMPP namespace prefix handling usi...

11. CVE-2026-57189 Asterisk: Possible RED T.140 Generation Accumulation OOB Write

    Published 2026-10-27

    Low·CVSS 2.3

    Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a T.140 RED out-of-bounds write during generation accumulation using carefully crafted packets, potentially allowing remote code execution or cau...

12. CVE-2026-57201 Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer

    Published 2026-10-27

    High·CVSS 7.5

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 ooTrace() trace-logging function can occur when unbounded vsprintf wr...

13. CVE-2026-57194 Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk

    Published 2026-10-27

    Medium·CVSS 5.9

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an out-of-bounds write in chan_unistim DIALPAGE digit handling can overflow the phone_number field and cra...

14. CVE-2026-57198 Asterisk: Possible RED T.140 Heap Buffer Overflow

    Published 2026-10-27

    Low·CVSS 2.3

    Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a T.140 RED heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The ch...

15. CVE-2026-57185 Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser

    Published 2026-10-27

    Medium·CVSS 6.5

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the PJSIP MWI body parser by se...

16. CVE-2026-57197 Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)

    Published 2026-10-27

    High·CVSS 7.7

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded memcpy of OGG/Speex packet data in format_ogg_speex can cause a heap buffer overflow and cras...

17. CVE-2026-57184 Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)

    Published 2026-10-26

    Medium·CVSS 6.3

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the chan_ooh323 Q.931 information-element parser permits an out-of-bounds...

18. CVE-2026-57193 Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)

    Published 2026-10-26

    Medium·CVSS 6.9

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver res_config_ldap may permit LDAP filter injection through a SIP username, allowing...

19. CVE-2026-57187 Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing

    Published 2026-10-26

    High·CVSS 7.1

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVIT...

20. CVE-2026-57196 Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages

    Published 2026-10-26

    Low·CVSS 2.3

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in phone provisioning HTTP error pages...

21. CVE-2026-23741 ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation

    Published 2026-02-06

    High·CVSS 8.8

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the asterisk/contrib/scripts/ast_coredumper runs as root, as noted by the NOTES tag on line 689 of the ast_coredumper file. The script wil...

22. CVE-2026-23740 Asterisk vulnerable to potential privilege escalation

    Published 2026-02-06

    High·CVSS 7.8

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, when ast_coredumper writes its gdb init and output files to a directory that is world-writable (for example /tmp), an attacker with write...

23. CVE-2026-23739 Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection

    Published 2026-02-06

    Medium·CVSS 6.5

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the ast_xml_open() function in xml.c parses XML documents using libxml with unsafe parsing options that enable entity expansion and XInclu...

24. CVE-2026-23738 The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization

    Published 2026-02-06

    Medium·CVSS 6.1

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/control values for Cookies and any GET variable query Parameter are directly interpolated into the HTML of the page using as...

25. CVE-2025-1131 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation

    Published 2025-09-23

    High·CVSS 7.0

    A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package. When Asterisk is started via this script (common in SysV init or FreePBX environments), it sources all .sh files located in /etc/asterisk/startup.d/ as root,...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.